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SAFEGUARDS  INFORMATION  SYSTEM  FLOWS  ASSOCIATED  WITH 
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John  C.  Schleter 
Technical  Analysis  Division 
National  Bureau  of  Standards 


ABSTRACT 

Increasing  use  of  nuclear  material  Imposes  additional  emphasis  on 
safeguards.     The  Technical  Analysis  Division,  NBS ,  has  been  assisting  the 
AEC  In  performing  systems  studies  directed  to  safeguards  for  nuclear 
materials.     A  Safeguards  Information  System  (SIS)   is  being  developed  so  as 
to  provide  the  information  and  decision  structure  needed  for  assurance  that 
significant  diversion  to  unauthorized  use  has  not  occurred  in  the  past  and, 
further,   that  any  significant  diversion  which  might  in  future  occur  will  be 
detected  in  a  timely  manner.     Although  a  comprehensive  report  is  in  prepar- 
ation, a  preview  is  considered  useful  at  this  time  in  order  to  familiarize 
plant  personnel,  charged  with  development  of  plant  safeguards  Information 
systems,  with  aspects  of  SIS.     This  report  thus  reflects  material  from  the 
forthcoming  report  and  directs  attention  to  the  information  flows  related 
to  the  key  safeguards  decision  maker  within  the  plant  -  the  plant  safeguards 
authority.     Terms  and  concepts  are  defined  and  their  application  is 
Illustrated  in  the  general  case  by  highlighting  decision  responsibilities 
and  details  of  the  safeguards  information  flows  associated  with  him. 

INTRODUCTION 

Of  constant  concern  to  the  AEC  is  the  possibility  of  illicit  removal  of 
special  nuclear  material   (SNM)   from  authorized  to  unauthorized  use.  Such 
removal  is  termed  diversion,  and  should  it  occur,  attention  is  directed  to 
the  location  where  the  SNM  was  last  accounted  for.     Focus  is  thus  on  plants, 
laboratories  and  transportation  activities  for  each  provides  the  potential 
dlverter  with  direct  access  to  SNM.     The  plants  are  of  particular  interest 
due  to  the  quantity  of  SNM  generally  on  hand  and  the  many  varied  opportuni- 
ties made  available  to  the  dlverter  by  virtue  of  the  complexity  and  size  of 
plant  operations. 

In  order  to  minimize  the  possibility  of  diversion,  consideration  must 
be  given  in  advance  to  the  various  facets  of  the  problem  and,   in  particular, 
to  the  methods  by  which  material  might  be  diverted  and  to  the  techniques  by 
which  diversion  might  be  detected.     One  common  thread  for  unraveling  this 
complex  problem  is  the  flow  of  Information  between  personnel  having  decision 
responsibility  for  safeguards.     Adequate  Information,  when  coupled  with 
plant  implementation  experience,  leads  to  the  design  of  a  plant  safeguards 
system  which  serves  as  one  mechanism  for  rapid  diversion  detection. 

Forethought  of  the  roles  of  the  various  decision  makers  permits 
characterization  of  the  information  flows  and  allows  one  to  make  statements 
concerning  the  information  to  be  contained  in  such  flows.     To  this  end,  the 
Technical  Analysis  Division,  NBS,  has  been  assisting  the  AEC  in  developing  a 
Safeguards  Information  System  (SIS)   so  as  to  provide  the  Information  and 
decision  structure  needed  for  assurance  that  significant  diversion  has  not 
occurred  in  the  past  and,  further,   that  any  significant  diversion  which 
might  in  future  occur  will  be  detected  in  a  timely  manner. 
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This  report  reflects  portions  of  a  forthcoming  comprehensive  report 
"Framework  of  the  Safeguards  Information  System  (SIS)"   [1]  which  is  cur- 
rently being  completed  in  greater  detail  and  broader  scope.     The  intent 
here  is  to  provide  an  example  for  designing  plant  systems  by  highlighting 
the  information  flows  associated  with  only  one  of  the  decision  makers  of 
safeguards,  the  plant  safeguards  authority.     Within  the  structure  of  SIS, 
he  is  responsible  for  design  and  review  of  the  plant  safeguards  informa- 
tion system  and  is  the  focal  point  of  plant  safeguards  activities;  most 
types  of  information  flows  identified  during  the  development  of  SIS  there- 
fore involve  him  in  one  way  or  another.     These  information  flows  may 
provide  plant  personnel  with  an  understanding  of  the  aspects  of  a 
generalized  information  system  and  the  description  of  their  derivation  may 
serve  as  a  guide  when  design  of  a  plant-specific  system  is  undertaken.  In 
essence,  this  report  provides  a  background  for  understanding  the  SIS 
concept,   illustrates  the  procedure  for  its  application  and  culminates  in  a 
complete  description  (in  detailed  outline  form)  of  the  information  needs 
and  flows  of  this  key  safeguards  decision  maker. 

1.     ASPECTS  OF  AN  INFORMATION  SYSTEM 

In  order  to  develop  and  describe  the  detailed  structure  or  framework 
of  an  information  system,  be  it  the  general  SIS  or  a  plant-specific  SIS, 
it  is  first  necessary  to  understand,   identify  and  state  (precisely  and 
accurately)   the  objectives  of  the  system.     The  objectives,   in  turn,  must 
reflect  the  goals  of  the  activities  which  the  information  system  is 
intended  to  serve.     For  safeguards,   the  goal  is  protection  of  the  public 
and  assurance  with  regard  to  threats  from  unauthorized  diversion  of  SNM; 
the  objectives  of  a  SIS  concern  provision  of  Information  in  event  of 
diversion  or  valid  assurance  that  diversion  has  not,   in  fact,  occurred. 
It  remains  to  identify  the  system  elements  which  comprise  a  SIS  and  to 
determine  their  relationships. 

To  be  effective,  SIS  must  be  extensive  and  comprehensive  in  terms  of 
spatial  and  temporal  coverage  and  with  respect  to  numbers  of  people  and 
types  and  amounts  of  information.     It  is  therefore  necessary  to  conduct  a 
logical  breakdown  and  examination  of  system  elements  and  their  interrela- 
tionships to  ensure  that  system  objectives  are  achieved.     Some  concepts 
which  are  usually  associated  with  information  system  analysis  are  useful 
in  giving  adequate  consideration  to  each  element  so  that  none  is  overlooked. 
In  particular,   the  concepts  of  nodes  and  flows  together  with  content  of 
nodes  and  purposes,  methods  and  content  of  flows  have  been  found  to  be 
useful. 

1. 1  Nodes 

In  the  context  used  here,   the  concept  of  nodes  encompasses: 
•  physical  locations,   such  as  an  AEC  Field  Office,  a  plant  or 
a  sub-unit  of  a  plant; 
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•  decision  points  or  decision  makers  within  locations  where 
safeguards  decisions'  are  reached  as  to  the  existence  of 
abnormal  situations^  and  the  status  of  design,  modification 
and  operation  of  the  safeguards  system; 

•  analysis  points  or  analysts  within  locations  where  SIS 
analysis  is  performed; 

•  sources  within  locations  where  data  and  information  are 
generated   (data  sources  and  information  sources) ;  and 

•  activities  performed  at  locations,  principally  of  a  review 
nature,  such  as  surveys  and  inspections. 

The  content  of  nodes  refers  to  documentation  maintained  in  the  node 
and  includes: 

•  records  and  reports,  either  manually  prepared  or  computer 
generated  (using  data  elements  accruing  in  this  or  another 
node) ; 

•  files  in  the  form  of  papers,  computer  cards  ("punched" 
cards),  or  magnetic- tapes ,  -  drums  or  -disks; 

•  logs  prepared  in  this  or  another  node;  and 

•  procedure  manuals  prepared  in  this  or  another  node. 

1. 2  Flows 

The  concept  of  flow  refers  to  the  transmittal  of  data  and  information 
from  an  origin  to  a  destination,  that  is,  between  any  two  nodes.     A  flow 
involving  an  intermediate  node  can  be  considered  as  two  separate  flows  of 
the  same  information  or  data,  where  the  intermediate  node  is  the  destina- 
tion on  the  one  hand  and  the  origin  on  the  other.     There  are  three  important 
aspects  of  a  flow:  purpose,  method,  and  content. 

The  purpose  of  flow  refers  to  the  reason  for  the  transmittal  and  divides 
flows  into  two  types: 

•  reporting  flows,   the  contents  of  which  serve  as  the  basis  for 
actions  or  decisions;  and 

•  administrative  flows,  which  serve  only  to  inform. 
The  methods  of  flow  fall  into  two  genral  classes: 

•  oral  flows  include  direct  conversation  between  individuals  or 
other  means  of  voice  communication,   such  as  telephone  or  radio; 
and 

•  written  flows  consist  of  hardcopy  reports   (either  manually 
prepared  or  computer  generated).  Teletype  (TTY)  messages, 
output  from  data  links  and  computerized  video  displays  (CRT 
displays) . 

The  content  of  flows  include: 

•  data  elements  such  as 

-  measurements  and 

-  identifications; 
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"Decisions"  include  all  responsibilities  for  safeguards  actions . 

2 

An  "abnormal  situation"  means  an  occurrence  inconsistent  with  that 
expected  which  can  be  related  to  possible  diversion. 
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•  information  elements,  for  example, 

-  processed  data  of  any  type,  including 

mental  computations, 
aggregations , 
comparative  analyses,  and 
statistical  analyses, 

-  observations 

-  probabilities, 

-  evaluation  of  probabilities 

-  historical  perspective, 

-  conclusions,  and 

-  assurance  statements; 

•  alerts;  and 

•  alarms. 

The  relationships  of  flows  among  nodes  can  best  be  represented 
schematically.     A  general  set  of  symbols  has  been  adopted  (given  in 
figure  1)   for  the  entities  described  above,  and  many  of  them  are  used  in 
the  schematic  diagrams  appearing  later  in  this  report;  all  are  used  in 
the  comprehensive  report.  [1]. 

2.     THE  DECISION  STRUCTURE 


The  safeguards  system  is  composed  of  a  great  many  decision  makers  who, 
depending  upon  their  relative  position  within  the  system,  may  be  called 
upon  or  be  responsible  for  a  number  of  different  types  of  judgments.  In 
order  to  comprehend  the  information  flows  associated  with  the  plant  safe- 
guards authority,  it  is  necessary  to  place  him  in  proper  context  among 
the  decision  makers  and  identify  those  with  whom  he  interacts. 

Before  doing  this,  however,  a  brief  discussion  of  safeguards  decisions 
is  in  order.     The  decisions  reached  by  cognizant  personnel,  based  on  infor- 
mation made  available  through  SIS,  allow  statements  about  diversion  to  be 
made  with  assurance  (e.g.,  that  diversion  has  not  taken  place  in  the  past, 
or  that,  should  diversion  occur  in  future,   indication  will  be  given  in 
timely  manner).     Decisions,  may,   for  example,  be  related  to  abnormal 
situations,   timely  indication  or  the  adequacy  of  available  information,  to 
name  but  a  few.     All  decisions  contribute  toward  the  confidence  given  to 
the  public  that  the  safeguards  system  is  working. 

Each  decision  maker  contributes  an  assessment  of  whether  or  not  the 
system  is  adequate  in  meeting  safeguards  goals  for  his  level  of  responsi- 
bility and  for  those  levels  subordinate  to  him.     Thus,  decisions  made  at 
each  level  serve  as  inputs  for  statements  related  to  assurance,  generally 
made  at  higher  levels  in  the  system.     For  purposes  of  SIS,  decision 
responsibilities  may  be  divided  into  two  types:   those  pertaining  to 
system  operation  and  those  pertaining  to  system  design  and  modification. 
The  former  include  recognition  of  any  abnormal  situations  which  develop 
and  also  determination  that  the  system  is  operating  properly  as  a  matter 
of  routine.     Such  responsibilities  properly  fall  to  those  within  the  plant 
who  oversee  daily  operations.     System  design  and  modification  responsi- 
bilities entail  judgment  of  the  adequacy  of  procedures  and  performance  of 
the  system  for  satisfying  safeguards  goals  and  are  the  province  of 
management. 
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Figure  1        SIS  Framework  Symbols 
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As  will  be  seen,   the  latter  are  primary  decision  functions  of  the 
plant  safeguards  authority.      (Additional  decision  functions  are  described 
in  a  latter  section).     Although  each  decision  maker  within  the  system  has 
specific  decision  functions, the  purposes  of  this  report  do  not  require 
that  they  be  detailed  here.     The  nature  of  the  decisions  required  of  the 
decision  makers,  however,  govern  the  detailed  content  of  the  nodes  and 
establish  the  specific  methods  and  content  of  the  information  flows. 

Decision  makers  are  identified  and  listed  in  Table  1,  grouped  into 
the  following  categories:  the  process  line,  storage,  shipping  and 
receiving,  transportation,  others  with  SNM  access,  physical  security  and 
management.     As  one  descends  through  these  groups,   the  accessibility  and 
directness  of  information  concerning  items  of  SNM  subject  to  diversion 
increases.     Several  secondary  decision  makers  are  included  in  the  table 
for  completeness.     These  decision  makers  are  located  at  the  management 
level,  and  their  activities  do  not  primarily  address  safeguards  functions. 
They  are,  however,   informed  of  any  abnormal  situations  and  may  be  called 
upon  to  make  administrative  decisions  with  regard  to  such  a  situation. 

In  a  given  facility,  one  individual  may  have  decision-making 
responsibilities  ascribed  in  this  report  to  more  than  one  decision  maker. 
Further,   the  term  decision  maker  refers  not  only  to  the  individual  having 
ultimate  responsibility  for  a  given  set  of  safeguards  decisions  but  also 
to  members  of  his  staff  who  contribute  to  his  decision  making  functions. 
Organizational  structures  differ  among  facilities,  hence  the  titles  used 
in  this  report  may  not  apply  universally; in  a  specific  plant  personnel 
must  be  related  by  means  of  significant  tasks  and  responsibilities  to  the 
generic  titles  used  here. 

Figure  2  emphasizes  the  relationships  among  decision  makers,   the  data 
sources  and  information  sources.     Data  sources  for  decisions,  indicating 
proximity  or  detailed  information  about  specific  items  of  SNM,  are  shown 
near  the  bottom  of  the  figure.     Above  each  data  source  is  shown  the 
relative  level  of  decision  maker  or  analysis  associated  with  it.  The 
vertical  relationship  of  the  decision  structure  to  the  data  sources  as 
shown  in  Figure  2  applies  through  the  plant  management  level.     Above  that 
level,  however,  decision  makers  are  concerned  with  broader  groupings  of 
data  sources,  such  as  several  facilities  within  a  field  office  or  several 
field  offices. 

Table  1  and  Figure  2  locate  the  organizational  position  of  the  plant 
safeguards  authority  within  the  safeguards  decision  making  hierarchy. 

3.     CONCEPTS  EMPLOYED  IN  SIS 


During  the  evolution  of  the  general  SIS,  concepts  of  the  unit  process, 
a  logic  of  response  to  abnormal  situations  and  diversion  path  analysis  were 
developed.     These  concepts  have  become  integral  components  of  the  informa- 
tion flows  associated  with  the  plant  safeguards  authority,  as  well  as  all 
decision  makers  of  the  system,  and  a  brief  statement  of  each  concept  is, 
therefore,  essential  to  full  understanding  of  the  information  flows 
described  later  in  this  report. 
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MANAGEMENT 

THE  PRESIDENT 

THE  JOINT  COMMITTEE  ON  ATOMIC  ENERGY  (JCAE) 
THE  ATOMIC  ENERGY  COMMISSION  (AEC) 
AEC  GENERAL  MANAGER 

AEC  ASSISTANT  GENERAL  MANAGER  FOR  NATIONAL  SECURITY,  HEADQUARTERS 
AEC  DIRECTOR  OF  REGUIATION ,  HEADQUARTERS 

AEC  DIRECTOR,   DIVISION  OF  SAFEGUARDS  A^jD  SECURITY,  HEADQUARTERS 
CHIEF,    INTERNAL  SECURITY  BRi\NCH ,  HEADQUARTERS 

CHIEF,  MATERIALS  A.\D  PLANT  PROTECTION  OPERATIONS  BRANCH,  HEADQUARTERS 
AEC  APPRAISER,  HEADQUARTERS 
FIELD  OFFICE  MANAGER 

FIELD  OFFICE  SOURCE  AND  SPECIAL  MATERIALS  REPRESENTATIVE  (SS  REP) 

FIELD  OFFICE  DIRECTOR  OF  SECURITY 

AEC  SURVEY  INSPECTOR,  FIELD  OFFICE 

AEC  SECURITY  INSPECTOR,  FIELD  OFFICE 

REGIONAL  TRANSPORTATION  CONTROL 

PLANT  Mi\NAGER 

PLANT  SAFEGUARDS  COMMITTEE 
PLANT  SAFEGUARDS  AUTHORITY 
PLANT  PRODUCTION  CONTROL  MANAGER 
PLANT  PHYSICAL  SECURITY  DIPvECTOR 

PHYSICAL  SECURITY 

PLA1>IT  GUARD  CAPTAIN 
PLANT  GUARD 

R6cD  AND  LABORATORY 

R&D  AREA  SUPERVISOR 
R&D  AREA  SNM  CUSTODIAN 
R&D  APvEA  TECHNOLOGIST 
ANALYTICAL  LABORATORY  SUPERVISOR 
ANALYTICAL  LABORATORY  SNM  CUSTODIAN 
ANALYTICAL  LABORiVTORY  CHEMIST 

TRANSPORTATION 

SNM  TRANSPORTATION  CUSTODIAN-DRIVER  OR  COURIER 

SHIPPING  AND  RECEIVING 

SHIPPING  DOCK  FOREMAN 
SHIPPING  DOCK  CLERK 

STORAGE 

PIANT  PHYSICAL  INSPECTOR 
VAULT  MAIUGER 

PROCESS  imE 

PROCESS  ENGINEER-U:nT  PROCESS  OR  MATERIAL  BALANCE  AREA 
SNM  CUSTODIAN-Mi\TERIAL  BALANCE  AREA 
PROCESS  FOREM^XN-M'^TERIAL  BALANCE  AREA 
PROCESS  OPERATOR-U^^IT  PROCESS 


Table  1      The  Safeguards  Decision  Makers 


7 


8 


'INC 

>  a. 

tJU 

O  ui 

O       ft.  >-'  O  W 


9 


3 . 1    The  Unit  Process  Concept 


The  unit  process  is  the  basic  "building  block"  for  SIS  design. 
Nuclear  plant  processes  are  complicated,  involving  material  flows  depen- 
dent on  many  variables  and  usually  unique  to  a  given  plant.   Consequently,  x 
in  order  to  perform  a  systematic  safeguards  analysis  for  a  given  plant, 
its  material  flows  and  data  variables  must  be  characterized.     It  then 
becomes  possible  to  apply  analytical  techniques  to  large  industrial 
facilities,  such  as  nuclear  plants, where  plant  operator  processes  and 
procedures  are  complex,  highly  interrelated  and  constantly  changing. 
Early  in  the  SIS  evolution,   it  was  found  that  many  processes  could  not 
be  adequately  analyzed  because  the  available  variables  did  not  permit 
relating  material  flows  to  one  another.     The  typical  problem  stemmed 
from  attempts  to  examine  data  from  too  large  a  portion  of  the  process. 
Also,   it  was  noted  that  the  lack  of  information  about  unmeasured  recycle 
strongly  affected  data  related  to  material  flows  external  to  the  portion 
of  the  process  under  study.     The  unit  process  concept  was  developed  to 
overcome  these  problems,  helping  to  achieve  modular  construction  of  an 
arbitrary  nuclear  plant  from  the  standpoint  of  SIS. 

In  this  concept  the  overall  process  stream  of  a  plant  is  subdivided 
into  many  smaller  operations  (the  unit  processes) ,  each  of  which 
introduces  a  "branch  point"  in  the  process  stream,  a  location  where 
material  changes  its  physical  or  chemical  form  or  composition,  or  where 
a  by-product  is  generated  (e.g.,  recycle,  scrap  or  waste).     The  combina- 
tion of  two  sources  of  feed  material  into  a  single  product  or  the 
machining  of  a  casting,  producing  product  and  scrap,  are  examples  of 
activities  within  simple  unit  processes.     More  types  of  material  flows 
may  be  involved,   the  key  to  the  concept  being  that  each  flow  can  be  well 
characterized  in  terms  of  material  quantity,  quality  and  destination. 
Nine  types  of  material  flows  (illustrated  schematically  in  Figure  3)  are 
identified  in  relation  to  the  general  unit  process;  all  flows  need  not  be 
utilized  in  the  operations  of  a  specific  unit  process.     The  nine  types 
are : 

•  feed  (from  the  preceding  unit  process  or  plant  storage) ; 

•  product  (to  the  next  unit  process  or  plant  storage) ; 

•  recycle  (characterized  feed-back  within  a  unit  process) ; 

•  recycle  from  another  unit  process; 

•  recycle  to  another  unit  process; 

•  scrap  to  recovery; 

•  waste  to  measured  discard; 

•  samples  to  the  laboratory;  and 

•  material  unaccounted  for  (MUF) . 

The  modular  aspects  of  the  unit  process  concept  as  applied  to  a 
hypothetical  plant  is  illustrated  in  Figure  4.     In  this  example,   it  is 
observed  that  the  scrap  recovery  areas,  S.l  through  S.ng,  do  not  involve 
all  possible  flows.     Further,  it  is  seen  that  a  number  of  unit  processes 
combine  to  form  a  single  material  balance  area  (MBA) ,  usually  considered 
(by  the  AEC)  as  the  smallest  sub-unit  within  a  plant  for  purposes  of 
accounting  and  inventory  information. 
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1.     FEED  (FROM  THE 
PRECEDING  UNIT 
PROCESS  OR  PLANT 
STORAGE) 


4.     RECYCLE  FROM 
ANOTHER  UNIT 
PROCESS 


THE  UNIT  PROCESS 


3.     MEASURED  OR 
CHARACTERIZED 
RECYCLE  FROM  THIS 
UNIT  PROCESS 


2.     PRODUCT  (TO  PLANT 
STORAGE  OR  THE  NEXT 
UNIT  PROCESS) 


'  9.     MATERIAL  UNACCOUNTED  FOR 
8,     SAMPLES  TO  LABORATORY 
7.     WASTE  TO  MEASURED  DISCARD 
6.     SCRAP  TO  RECOVERY 
RECYCLE  TO  ANOTHER  UNIT  PROCESS 


Figure  3       Unit  Process  Material  Flows 
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3. 2    Logic  of  Response  to  Abnormal  Situations 

This  concept  suggests  a  set  of  guidelines  which  might  be  implemented 
as  policy  for  directing  response  to  observed  abnormal  situations.  There 
are  four  principle  ideas  incorporated  in  this  concept: 

o  two-level  reporting; 

o  resolution  feedback; 

o  the  abnormal  situation  log;  and 

o  the  elapsed  time  clock. 

A  logic  diagram  of  the  interrelationship  of  these  principles  for 
decision  and  action  steps  in  the  face  of  an  abnormal  situation  is 
illustrated  in  Figure  5.     The  levels  "n" ,  "n+1"  and  "n+2"  of  Figure  5 
refer  to  a  set  of  relative  action  levels  of  decision  makers  in  the 
safeguards  decision  structure  (Figure  2).     The  cognizant  decision  maker 
to  be  identified  at  each  level  is  determined  by  the  abnormal  situation 
reporting  flow  for  each  data  source,  shown  superimposed  on  the  decision 
structure  in  Figure  6,  and  the  time  required  for  resolution.     As  an 
example,   for  the  "material  in  process"  data  source  at  discovery  of  an 
abnormal  situation,  observation  and  subsequent  action  rests  with  the 
process  foreman  (level  "n+1")     and  review  and  administrative  follow-up 
with  the  process  engineer  (level  "n+2") .     If  the  abnormal  situation  is 
unresolved  within  prescribed  time,  additional  resources  must  be  called. 
For  this  round  of  investigation,  level  "n"  shifts  to  the  process  foreman, 
level  "n+1"  to  the  process  engineer  and  level  "n+2"  to  the  plant  safe- 
guards authority.     Each  call  for  additional  resources  reflects  the 
increased  seriousness  of  delayed  resolution  and  brings  the  next  higher 
decision  maker  and  his  information  to  the  investigative  team. 

Two-level  reporting  is  the  thesis  that  any  abnormal  situation  be 
reported  not  only  to  the  logical,  immediate  supervisor  (who  is  required 
to  take  necessary  action) ,  but  also  to  the  next  higher  echelon.     This  has 
the  effect  of  insuring  that  action  is  taken  in  an  abnormal  situation  and 
that  action  is  not  delayed  in  hopes  of  resolution.     Moreover,  with  two- 
level  reporting,  a  scattering  of  abnormal  situations  throughout  a  plant, 
each  not  especially  unusual  in  its  area,  will  not  go  unnoticed  in  the 
aggregate. 

Resolution  feedback  is  important  not  only  for  the  obvious  functional 
purpose  of  terminating  lower  level  response  when  the  apparent  abnormality 
was  caused  innocently,  but  also  for  deterrence,  yet  another  goal  of 
safeguards.     That  is,   the  system  response   is  believably  demonstrated  to 
individuals  at  lower  levels  and  they  became  aware  that  action  is  taken  in 
reply  to  a  report  of  an  abnormal  situation.     In  contrast,  the  belief  that 
an  abnormal  situation  will  be  ignored  encourages  the  tendency  either  to 
fail  to  report  the  abnormal  situation  or  to  assume  that  others  will  fail 
to  report,  making  it  possible  to  divert  material  without  getting  caught. 

The  abnormal  situation  log  is  kept  by  each  decision  maker  at  the 
facility  level,    (see  Figure  2)  except  the  plant  manager  and  the  plant 
safeguards  committee.     It  is  a  record  of  each  abnormal  situation  occurring 
in  a  data  source  over  which  the  decision  maker  has  cognizance.     It  includes 
references  to  the  data  which  first  indicated  the  abnormal  situation,  all 
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Logic  Diagram  for  Actions  Related  to  Abnormal  Situations 
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pertinent  dates  and  times,   the  response  and  the  resolution  of  the  situation. 
Innocent  causes  of  abnormal  situations  are  also  listed,  and  should  the  in- 
dication be  due  to  an  error  in  system  design  or  to  a  process-related  problem, 
this  will  become  apparent.     The  system  can  then  be  modified  for  improved 
handling  of  indications  from  innocent  causes  in  the  future.     When  within  the 
purview  of  the  decision  maker,  recommendations  for  solutions  to  system  design 
problems  should  also  be  included  in  the  log. 

The  records  maintained  as  the  abnormal  situation  log  are  essential  for 
evaluation  of  the  system  and  are  fundamental  to  modifications  of  its  design. 
It  contains  key  evidence  that  the  system  is  functioning  at  a  given  location 
and  helps  to  give  assurance  for  reporting  of  future  abnormal  situations. 
A  pattern  of  abnormal  situations  traceable  to  a  given  individual  or  process- 
ing areas  will  also  become  apparent  so  that  corrective  action  can  be  taken. 

The  "elapsed  time  clock"  effectively  restricts  the  total  time,  ET^^,  to 
be  allowed  for  investigation,  establishment  of  an  innocent  cause,  or 
resolution  of  an  abnormal  situation  before  additional  action  must  be  taken. 
At  a  given  level  "n"   (as  shown  in  Figure  5) ,   this  maximum  allowable  time  may 
be  characterized  as: 

ET    =  f(MA,  S   ,  S   ,  S   ,  n), 

n  MIS 

where  ^ 
MA  =  material  attractiveness  , 
S    =  mass  sensitivity'^, 

.  .  5 

=  time  sensitivity  , 

S     =  space  sensitivity  ,  and 

n    =  cognizant  person  or  decision  level. 


A  means  of  expressing  the  idea  that  when  several  material  types  (i.e., 
the  nuclear  properties  of  the  SNM)  or  descriptions  (i.e.,   the  physical 
or  chemical  form  of  the  SNM  as  distinguished  from  material  type)  are 
subject  to  illicit  removal  from  an  area,  some  may  be  more  desirable  to 
a  diverter  than  others  because  of  the  ready  or  easy  adaption  to  intended 
end-use . 

An  attribute  of  diversion  indication  for  denoting  that  in  the  event  of 
a  diversion  of  a  threshold  mass  of  X  grams,  there  is  at  least  a  p% 
probability  that  a  signal  in  the  information  (i.e.,  an  abnormal  situ- 
ation) will  result  which  will  serve  to  initiate  additional  investigation. 
Also,   the  specification  of  the  quantity  of  the  threshold  mass. 

An  attribute  of  diversion  indication  for  denoting  that  in  the  event  of 
diversion,  there  is  at  least  a  p%  probability  that  there  will  be  a  sig- 
nal in  the  information  (i.e.,  an  abnormal  situation)  observed  wthin 
d  days.     Also,  the  specification  of  the  time  interval  within  which 
observation  should  occur. 

An  attribute  of  diversion  indication  for  denoting  that  in  the  event  of 
diversion,   there  is  at  least  a  p%  probability  that  there  will  be  a  signal 
in  the  information  (i.e.,  an  abnormal  situation)  pinpointing  the  areas 
wherein  removal  occurred  and  highlighting  the  personnel  having  access  to 
the  SNM.     Also,  the  specification  of  the  area  and  personnel. 
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It  must  be  remembered,  however,   that  "ETj^"  is  a  function  of  "n" ,  and  must 
therefore  be  re-evaluated  each  time  "n"  is  incremented.     In  general,  "ET^" 
will  decrease  as  "n"  increases. 

The  elapsed  time  clock  is  interrogated  at  the  three  decision  points 
(refer  to  Figure  5)  designated  "Elapsed  Time  Check".     The  interrogation 
indicated  at  level  "n+2"  is  included  to  imply  two-level  reporting  (that  is 
the  cognizant  person  at  level  "n+2"  has  a  responsibility  to  see  that  action 
is  taken  at  level  "n+1"  within  the  specified  elapsed  time).     Once  the 
allowed  time  has  elapsed,   the  next  level  of  assistance  and  responsibility 
must  be  called  upon  as  a  matter  of  routine.     This  concept  removes  from 
negotiation  the  decision  as  to  whether  or  not  to  call  for  help  since  it 
insures  that  additional  resources  will  be  brought  in  to  resolve  abnormal 
situations  when  necessary. 

Since  each  abnormal  situation  implies  the  possibility  of  diversion, 
time  is  of  the  essence:  there  must  be  no  unnecessary  delay  in  sounding  an 
alarm  when  an  alarm  is  warranted.     With  a  fixed  time  schedule  for  alerting 
the  next  higher  echelon,  no  judgment  in  regard  to  elapsed  time  need  be 
exercised  by  the  decision  maker.     The  concept  prevents  adoption  of  a  "wait 
and  see"  attitutde,  and  further  insures  that  abnormal  situations  likely 
due  to  diversion  will  be  identified  in  a  timely  manner  as  not  being  due  to 
innocent  cause. 

The  abnormal  situation  log,  with  the  requirement  for  noting  times, 
will  help  to  determine  whether  the  elapsed  time  requirement  is  being  adhered 
to  and  will,  in  turn,  allow  time-response  assurance  statements  to  be  made. 
Thus,  the  elapsed  time  clock  is  perhaps  the  most  important  element  of  the 
concept  for,  by  assuring  that  the  time  sensitivity  of  safeguards  is  met,  it 
dictates  the  making  of  a  timely  response  to  possible  diversion. 

When  the  decision  maker  realizes  that  an  abnormal  situation  exists,  it 
is  incumbent  upon  him  to  act.     Choice  of  action  is,  in  itself,  a  decision 
responsibility  and  is  dependent  upon  the  diversion  path.     Each  decision 
maker  is  exposed  to  a  number  of  diversion  paths^,  depending  upon  the  data 
source  over  which  he  has  purview,  and  can  often  observe  more  than  one 
abnormal  situation  for  a  specific  path.     Each  of  the  abnormal  situations  is 
observed  by  means  of  an  available  element  of  information  which  enables  him 
to  recognize  the  situation  and  initiate  his  actions.     The  choice  of  the 
sensitive  element  of  information  which  allows  recognition  of  the  abnormal 
situation  results  from  application  of  the  last  concept,  diversion  path 
analysis. 

3. 3    Diversion  Path  Analysis 

The  key  to  safeguards  at  the  plant  level  is  recognition  of  the 
existence  of  the  abnormal  situation,  one  which  prompts  the  question:  "Has 
diversion  occurred?"     The  recognition  responsibility  resides  with  one  of 
the  decision  makers  identified  earlier  who,  when  specified  for  a  given 
plant  area,  must  be  provided  with  mechanisms  to  alert  him  to  action  based 
on  available  information  and  the  possible  ways  material  could  be  diverted 
from  the  area. 

7  The  complete  and  detailed  description  of  a  modus  operandi  and  rationale, 
devised  as  an  independent  method,   for  illicitly  removing  and  concealing 
the  removal  of  SNM. 
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For  a  decision  maker  to  become  quickly  aware  of  a  relevant  abnormal 
situation  and  its  potential  significance,  his  area  of  responsibility  must 
be  analyzed  in  advance  and  diversion  paths  made  known.     In  the  scope  of 
SIS,  such  analyses  would  be  performed  by  the  plant  safeguards  authority 
(or  a  member  of  his  staff) ,  assisted  by  the  process  engineer^  and  process 
foreman  of  the  area  under  scrutiny,  subject  to  review  by  the  AEC  Field 
Office.     The  procedure  for  directing  the  systematic  analysis  is  termed 
diversion  path  analysis  (DPA) .     Details  of  the  steps  used  in  applying  the 
procedure  are  given  elsewhere  [2];  in  brief  all  conceivable  diversion 
possibilities  are  identified  and  classified  in  descending  order  of 
seriousness  and  likelihood  of  occurrence.     Information  elements  and  safe- 
guards activities  are  matched  to  possible  diversions  and  the  information 
used  in  the  design  of  SIS  is  generated  in  order  to  satisfy  the  safeguards 
objectives.     Concomitantly,  consideration  is  also  given  to  innocent 
explanations  of  seemingly  alarming  situations  so  that  the  decision  maker 
has  an  informed  basis  for  his  actions. 

The  DPA  concept  is  vital  in  safeguards.     The  cognizant  authority 
at  each  level  must  be  confident  that,  insofar  as  possible,  all  diversion 
paths  have  been  examined,   that  these  paths  have  been  systematically 
ordered  or  ranked  by  establishable  criteria;  and  that  attention  is  focused 
on  the  more  probable  paths,  at  the  same  time  reducing  or  eliminating 
further  consideration  of  less  probable  ones.     Once  diversion  paths  have 
been  traced,  the  data  elements  and  their  respective  sources  (either  currently 
available  or  readily  made  available)  are  identified.     These  data  elements 
are  used  to  derive  a  set  of  variables,  which  are  in  turn  analyzed  either 
numerically  or  comparatively  as  diversion  indicators.     Identification  of 
data  elements  relative  to  the  most  probable  paths,   individually  considered, 
and  performance  of  associated  data  analyses  permit  the  cognizant  decision 
maker  to  conclude  at  a  high  level  of  confidence  whether  or  not  diversion 
has  occurred.     His  assurance  may  be  expressed  in  the  form  of  statements 
which  provide  information  about  the  probability  that  verification,  accounting 
and  the  adopted  procedures  accurately  reflect  the  current  status  and  operation 
of  the  safeguards  system. 

4.     DECISION  RESPONSIBILITIES  OF  THE  PLANT  SAFEGUARDS  AUTHORITY 


Having  conceptualized  the  general  types  of  information  which  decision 
makers  need  to  carry  out  their  safeguards  activities,  specific  responsi- 
bilities and  activities  of  the  plant  safeguards  authority  must  be  examined 
in  detail  in  order  to  prescribe  the  information  he  requires. 

The  title  "plant  safeguards  authority"  is  generic  and  was  established 
during  the  evolution  of  SIS.     The  safeguards  tasks  and  activities  assigned 
to  the  plant  safeguards  authority  have  been  laid  down  in  accord  with  the 
overall  SIS  structure  and  serve  as  a  guide  which,  when  applied,  will 
assure  that  all  tasks  and  activities  are  performed  and  that  the  content  of 
the  information  flows  is  complete. 


The  process  engineer  is  the  professional   (or  professionals)  directly 
responsible  for  improvements  to  the  process  and  for  the  specification 
of  the  internal  and  process  controls  to  be  used  in  the  process  area. 
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At  some  facilities  another  designator  may  be  used  (for  example, 
Nuclear  Materials  Control) ,  or  the  safeguards  tasks  and  activities  here 
prescribed  may  be  performed  by  more  than  one  person.     Thus,  for  a  specific 
plant,  safeguards  tasks,  activities  and  responsibilities  must  be  examined 
in  light  of  this  guide  in  order  to  pinpoint  the  individual  most  nearly 
matching  this  decision  maker.     If  the  tasks  actually  performed  by  the 
identified  individual  are  not  those  prescribed  by  SIS,  a  careful  review 
is  in  order.     Consideration  might  be  given  to  plant  task  reassignments  as 
a  means  of  better  approximating  SIS.     If  this  is  infeasible  for  admini- 
strative or  other  reasons,  great  care  must  be  exercised  in  the  design  of 
the  plant  SIS  in  order  to  insure  that  all  safeguard  tasks,  activities  and 
responsibilities  set-forth  in  the  general  SIS  are  assigned  to  specific 
decision  makers  and  that  the  associated  information  flows  accurately 
reflect  these  assignments. 

4. 1    Tasks  and  Safeguards  Activities 

The  plant  safeguards  authority  has  first-line  responsibility  for 
decisions  pertaining  to  safeguards  system  design,  modification  and 
operation.     With  assistance  from  process  engineers  and  process  foremen  of 
the  unit  processes  or  MBA's  under  scrutiny,  he  conducts  the  diversion  path 
analysis  [2].     For  each  process  area  under  analysis,  he  determines  whether 
all  pertinent  path  ordering  parameters  are  considered,  that  all  paths 
having  a  relative  path  weight  greater  than  boundary  conditions  set  forth 
in  corporate  or  AEC  guidelines  are  exhaustively  analyzed,  and  that  each 
analysis  is  properly  documented.     He  is  responsible  for  decisions  that 
time  factors  associated  with  the  elapsed  time  clock  (Section  3.2)  are 
realistic  and  sufficient,  and  that  diversion  path  documentation  accurately 
reflects  the  diversion  paths,  abnormal  situations  to  be  observed,  possible 
innocent  causes,   information  needs  and  responses  of  the  observer,  and 
cognizant  persons  to  be  notified  in  event  of  an  abnormal  situation.  He 
verifies  that  internal  control  procedures  incorporate  observation  for  and 
reporting  of  abnormal  situations  highlighted  as  diversion  indicators. 

Irregular  event  procedures  dictate,  upon  notification  by  the  plant 
guard  captain,  that  the  plant  safeguards  authority  initiate  appropriate 
safeguards  actions  such  as  special  inventory  of  the  area  involved,  call  for 
computer  preparation  of  current  inventory  lists  for  unit  processes  and 
MBA's  in  the  area,  etc. 

When  notified  by  the  production  control  manager  that  a  portion  of 
the  process  is  under  revision,   the  plant  safeguards  authority  conducts 
the  review  and  up-dates  the  diversion  path  analyses  relating  to  the 
affected  unit  processes  to  insure  that  the  analyses  include  any  new  diver- 
sion paths  which  result  from  the  change  and  to  delete  old  paths  which  are 
no  longer  applicable. 

He  is  responsible  for  design  of  sampling  plans  on  which  are  based  the 
computer  generated  random  lists  for  use  by  the  plant  physical  inspector^; 


The  plant  physical  inspector  performs  random  inspections  of  the  facility, 
within  the  plant  perimeter,  directed  specifically  towards  safeguards 
rather  than  physical  security.     Included  are  spot-checks  for  item  presence 
using  a  list  of  items  which  is  randomly  generated  from  the  general  inven- 
tory file  maintained  in  the  plant  data  processing  system  and  observations 
(on  a  random  and  unannounced  basis)   for  lapses  in  procedures. 
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for  initiating  the  establishment  and  improvement  of  measurement  programs 
which  are  aimed  at  reducing  uncertainty  of  measurements  and  uncertainty 
of  MUF,  particularly  if  such  programs  are  not  specifically  required  for 
production  control;  and  the  development  of  experimental  procedures  which 
verify  measurement  and  MUF  uncertainty  calculations,  indicator  sensitivity 
and  overall  system  operation.     Each  of  these  tasks  and  responsibilities 
lead  to  decisions  that  the  overall  system  is  properly  designed  or  that 
necessary  modifications  are  expeditiously  accomplished. 

Further  responsibilities  include  design  of  the  plant  materials 
accounting  and  other  internal  control  procedures.     Since  data  elements 
collected  for  accounting  and  control  (even  though  later  aggregated  for 
reporting  purposes)  are  often  analogous  to  those  needed  for  safeguards, 
the  plant  safeguards  authority  is  responsible  for  decisions  that  accounting 
and  control  information  and  data  accurately  reflect  material  and  informa- 
tion flows  within  the  plant.     He  also  assures  that  duplication  of  data 
taken  for  each  purpose  (safeguards,  accounting  or  internal  control)  be 
minimized  through  careful  design  of  all  systems. 

He  is  responsible  for  the  daily  operation  of  the  system  and  for 
decisions  related  to  system  operation  which  include  evaluation  of  MUF  and 
the  uncertainty  of  MUF,  resolution  of  shipper-receiver  differences  (S-R's) 
between  plant  MBA's  and  the  plant  and  other  facilities,  physical  inventory 
verification  through  activities  of  the  plant  physical  inspector  (general 
inventory  activities  are  performed  by  production  control),  and  audit, 
review  and  verification  of  all  facets  of  safeguards  procedures  associated 
with  plant  MBA' s. 

The  plant  safeguards  authority  is  the  focal  point  for  safeguards  inter- 
actions between  the  production  side  of  the  plant,   through  the  process 
engineers,  and  the  quality  control  laboratories  with  reference  to  calibra- 
tion and  measurement  control  programs.     He  is  also  responsible  for  safeguards 
interaction,  through  the  plant  manager,  with  the  cognizant  AEC  Field  Office 
SS  Rep  and  is  the  principal  contact  within  the  plant  during  AEC  Field  Office 
Survey  inspections. 

4.2     Information  Needs 

In  order  to  carry  out  his  responsibilities  for  system  design, 
modification,  and  operation,  and  reach  meaningful  decisions,   the  plant 
safeguards  authority  requires  the  following  information: 

•  facility-wide  SNM  accounting  records; 

•  results  of  physical  inventories; 

•  current  and  historical  facility  MUF  data; 

•  narrative  explanations  of  historical  MUF; 

•  current  and  historical  S-R  data  (inter-  and  intra-plant) ; 

•  calibration  program  measurement  data; 

•  data  on  uncertainty  of  measurements; 

•  production  control  data; 

•  changes  in  production  operations  within  unit  processes; 

•  full  particulars  of  irregular  events  such  as  fires, 
demonstrations  or  natural  disasters;  and 

•  overall  knowledge  of  attractiveness,   form  and  quantity 
of  SNM  in  MBA's  and  unit  processes. 
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5.     DETAILED  INFORMATION  FLOWS  FOR  THE  PLANT  SAFEGUARDS  AUTHORITY 


The  detailed  information  flows  associated  with  the  plant  safeguards 
authority  within  the  SIS  structure,  are  defined  once  the  interacting  nodes 
and  flows  are  identified,   the  interrelationships  set  forth,  and  the  node 
content  and  flow  content  listed.     This  is  not  meant  to  imply,  however,  that 
once  defined,  the  structure  cannot  or  should  not  be  changed.     The  concept 
of  SIS,  when  correctly  applied,  permits  modification  of  those  portions  of 
the  structure  subject  to  change  because  of  new  objectives  or  needs  without 
requiring  overhaul  of  the  entire  SIS.     The  caveat  given  above  regarding 
review  of  safeguards  tasks,  activities  and  responsibilities  of  personnel  in 
a  specific  plant,  must,  none  the  less,  be  observed. 

Details  of  the  information  content  and  flow  associated  with  the  plant 
safeguards  authority  will  be  presented  in  terms  of  the  SIS  structure  rather 
than  in  terms  of  an  actual  operating  system.     In  actual  practice,  a  plant's 
SIS  document  must  be  specific.     For  example,   it  might  state  in  relation  to 
an  abnormal  situation  observed  by  a  process  foreman.  A,   in  an  MBA  Q3: 
"Upon  observing  abnormal  situation  Sn,  A  will:    (1)  notify  B  (his  process 
engineer)  by  telephone  within  M  minutes;    (2)  complete  abnormal  situation 
reporting  form  F  (shown  in  exhibit  E) ;    (3)   file  the  original  of  the  form 
in  the  abnormal  situation  log  L,  kept  in  MBA  Q3  at  a  designated  location; 
and  (4)   forward  copy  1  of  the  form  to  B  and  copy  2  to  C  (the  plant  safe- 
guards authority)  within  H  hours."     Further,  the  plant  SIS  document  would 
list  all  abnormal  situations,   S^^,   for  the  given  unit  process  or  MBA,  state 
explicitly  the  allowable  elapsed  times,  M  and  H,  associated  with  each 
situation  or  class  of  situations,  and  give  names,  job  titles,  phone  numbers 
and  plant  addresses  of  the  individuals,  B  and  C,  referred  to  in  the 
statement.     In  contrast,   the  general  description  for  the  plant  safeguards 
authority  which  follows  will  indicate  simply  "abnormal  situation  informa- 
tion will  be  transmitted  from  X  to  Y"  and  will  indicate  generically  who 
the  decision  makers  are.     Emphasis  is  placed  on  the  flows,  methods  of  flow, 
forms  and  documents  to  be  used  (in  general  terms) ,  and  the  general  distribu- 
tion paths  for  the  documents  and  forms.     AEC  forms  are  referenced  by  number, 
but  forms  and  documents  likely  to  be  plant  specific  are  described  only  in 
general  terms. 

The  information  flows  associated  with  each  of  the  nodes  of  SIS  are 
addressed  in  detail  in  the  comprehensive  report   [1].     It  is  useful,  at  this 
point,   to  introduce  some  of  these  details ,  summarized  in  the  form  of  several 
lists,   in  order  to  further  pinpoint  the  plant  safeguards  authority  within 
the  general  framework.     The  nodes  of  SIS,   subdivided  by  location,  decision 
maker,  data  generating  activities  and  information  generating  activities  are 
listed  in  Table  2.     The  flows  are  listed  in  Table  3  as  a  function  of  end- 
point  node,   including  flows  for  reporting  purposes  between  decision  makers 
and  flows  to  information  and  analysis  systems.     The  content  of  the  SIS  infor- 
mation flows  is  listed,  in  general  terms,   in  Table  4. 

Most  of  the  flows  listed  in  Table  3  are  bi-directional,   that  is, 
information  is  transmitted  from  either  end-point  node  to  the  other.  Content 
of  the  flow,  however,  usually  depends  on  the  direction  of  flow.  For 
example,  the  process  engineer  forwards  to  the  plant  safeguards  authority 
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LOCATIONS 

A.  Top  echelon  of  Government 
lo  Office  of  the  President 

2.  Office  of  the  Joint  Committee  on  Atomic  Energy 

B.  AEC  Headquarters 

C.  International  Atomic  Energy  Agency 

D.  Computer  Sciences  Division,  NMIS  Department,  Oak  Ridge 

E.  AEC  Field  Offices 

F.  Law  enforcement  units 

1.  Local  police 

2.  Federal  Bureau  of  Investigation  Field  Offices 

3.  Federal  Bureau  of  Investigation  Headquarters 

G.  Transportation  elements 

1.  Regional  Transportation  Control  Centers 

2.  Transportation  units  enroute 

H.  Independent  AEC  laboratories 

I.  Plants 

1.  Processing  areas 

2.  R&D  areas 

3.  Analytical  laboratories 

4.  Storage  areas 

5.  Shipping  and  receiving  areas 

6.  Nuclear  materials  control  unit 

7.  Corporate  internal  audit  unit 

8.  Physical  security 

9.  Central  data  processing 
10.  Management 

DECISION  MAKERS 

A.  Management  (reporting  channels) 
lo  The  President 

2.  The  Joint  Committee  on  Atomic  Energy  (JCAE) 

3.  Atomic  Energy  Commission,  Headquarters 

a.  Commissioners 

b.  General  Manager  (GM) 

c.  Assistant  General  Manager  for  National  Security  (AGMNS) 

d.  Director  of  Regulation 

e.  Director,  Division  of  Safeguards  and  Security  (DSS) 

f.  Assistant  Director  for  Inspection  and  Appraisal  (A/D  I&A) ,  DSS 

g.  Chief,   Inspection  and  Appraisal  Branch  (I&A  Branch),  DSS 

h.  Chief,   Internal  Security  Branch   (IS  Branch),  DSS 

i.  AEC  Appraiser 

4.  Atomic  Energy  Commission,  Field  Offices 

a.  Manager 

b.  Source  and  Special  Materials  Representative  (SS  Rep) 

c.  Director  of  Security 

d.  AEC  Survey  Inspector 

e.  AEC  Security  Inspector 

5.  Regional  Transportation  Control 

6.  Plants 

a.  Manager 

Table  2       The  Nodes  of  SIS 
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bo  Plant  Safeguards  Authority 
c.   Physical  Security  Director 

B.  Management  (administrative  channels) 

1.  Director,  Federal  Bureau  of  Investigation 

2.  Atomic  Energy  Commission,  Headquarters 
ao  Directors,  program  divisions 

b.  Directors,  staff  divisions 

3.  Plants 

a.  Safeguards  Committee 

b.  Production  Control  Manager 

C.  Investigative  Forces 

1.  Agents,  Federal  Bureau  of  Investigation,  Headquarters 

2.  Agents,  Federal  Bureau  of  Investigation,  Field  Offices 

D.  Transportation 

1.  SNM  Transportation  Custodian,  Driver 

2.  SNM  Transportation  Custodian,  Courier 

E.  Plant 

1.  Physical  Security 

a.  Guard  Captain 

b.  Guard 

2.  R&D  Area 

a.  Supervisor 

b.  SNM  Custodian 

c .  Technologist 

3.  Analytical  Laboratory 

a.  Supervisor 

b.  SNM  Custodian 

c.  Chemist 

4.  Shipping  and  Receiving 

a.  Shipping  Dock  Foreman 

b.  Shipping  Dock  Clerk 

5.  Storage 

a.  SNM  Custodian  (MBA) 

b.  Plant  Physical  Inspector 

c.  Vault  Manager 

6.  Process  Line 

a.  Process  Engineer  (Unit  Process  or  MBA) 

b.  SNM  Custodian  (MBA) 

c.  Process  Foreman  (MBA  or  Several  Unit  Processes) 

d.  Process  Operator  (Unit  Process) 

III.   DATA  GENERATING  ACTIVITIES 

A.  Material  Transfer  Activities 
1.  Receiving 

a.  Observations 

1)  Material  from  Off-site 

2)  Internal  Transfers 

b.  Measurements 

1)  Material  from  Off-site 

2)  Internal  Transfers 

Table  2    (continued)       The  Nodes  of  SIS 
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2.  Shipping 

a.  Observations 

1)  Material  going  Off-site 

2)  Internal  Transfers 

b.  Measurements 

1)  Material  going  Off-site 

2)  Internal  Transfers 

B.  Material  Processing  Activities 

1.  Batch  Make-up 

2.  Sampling 

3.  Changing  of  Form 

a.  Physical 

b.  Chemical 

c.  Isotopic 

4.  Control  Measurements 

a.  Process 

b.  Quality 

C.  Internal  Control  Activities 

1.  Health  and  Safety 

a.  Measurements 

b.  Monitoring 

2.  Physical  Security  Observations 

3.  Diversion  Path  Analyses 

4.  Abnormal  Situation  Activities 

5.  Internal  Audit 

D.  Material  Balance  Accounting  Activities 

1.  Striking  the  Balance 

2.  Inventory  Taking 

3.  Composition  of  Ending  Inventory  (COEI) 

4.  Inventory  Verification 

E.  Analytical  Laboratory  Measurements 

F.  R&D  Area  Measurements 

G.  Scheduling  Activities 

1.  Preparation  of  Work  Orders  by  Process  Engineer 

2.  Scheduling  Work  Orders 

a.  Analytical  Laboratory  Supervisor 

b.  R&D  Area  Supervisor 

3.  Preparation  of  Plant  Schedules  by  Production  Control  Manager 

H.  Plant  Safeguards  Committee  Recommendations 

I.  Plant  Safeguards  Authority  Reports  To: 

1.  Plant  Manager 

2.  AEC  Field  Office 
J.  AEC  Survey  Activities 

1.  Sampling  and  Independent  Measurements 

2.  Independent  Inventory  Verification  Observations 

3.  Other  Observations 

K.  AEC  Appraisal  Activities 

IV.   INFORMATION  GENERATING  ACTIVITIES 
A.  Data  Processing  Activities 

Table  2    (continued)       The  Nodes  of  SIS 
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1.  Plant  Process  Areas 

2.  Plant  Central  Data  Processing  Facility 

3.  Plant  Accounting  Activities 

4.  Computer  Sciences  Division,  NMIS  Department,  Oak  Ridge 

5.  AEC  Headquarters 

B.  Diversion  Path  Analyses 

C.  Reaching  Conclusions  Based  On: 

1.  Abnormal  Situation  Information  Assessment 

2.  Evaluation  of  Process  Data  Obtained  from  all  Data  Processing 
Activities  (IV. A.) 

3.  AEC  Survey  Evaluations 

a.  General 

b.  Material  Balance  Accounting 

1)  Measurement  Systems 

2)  Record  Systems 

3)  Book  Inventory 

4)  Physical  Inventory 

5)  Measurement  Control  Program 

6)  Uncertainties  in  Measurements 

7)  Calculation  of  Uncertainty  in  MUF 

8)  MUF  Analysis  and  Evaluation 

c.  Systematic  Analytical  Alerting  and  Assurance  Procedures 

1)  Review  of  Procedures 

2)  Review  of  Diversion  Path  Analyses 

3)  Review  for  Completeness 

4)  Review  of  Abnormal  Situation  Logs 

5)  Evaluation  of  Procedures 

d.  Review  of  Abnormal  Situations  Observable  by  AEC  Survey 
Inspector 

4.  AEC  Appraisal  Evaluations 

a.  General 

b.  Personnel 

1)  Capability 

2)  Performance 

c.  Field  Office  Survey  Activities 

1)  On-site  Reviews 

2)  Work  Papers 

3)  Resulting  Assurance  Statements 

D.  Generation  of  Assurance  Statements 
1.  Within  Plant 

a.  Process  Areas 

1)  Process  Operator  to  Process  Foreman 

2)  Process  Foreman  to  Process  Engineer 

3)  MBA  SNM  Custodian  to  Process  Engineer 

4)  Process  Engineer  to  Plant  Safeguards  Authority 

b.  Physical  Security 

1)  Plant  Guard  to  Plant  Guard  Captain 

2)  Plant  Guard  Captain  to  Physical  Security  Director 

3)  Physical  Security  Director  to  Plant  Safeguards  Authority 

Table  2    (continued)       The  Nodes  of  SIS 
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c.  R&D  Areas 

1)  R6cD  Technologist  to  R&D  Supervisor 

2)  R&cD  SNM  Custodian  to  R&D  Supervisor 

3)  R&D  Supervisor  to  Plant  Safeguards  Authority 

d.  Analytical  Laboratory 

1)  Laboratory  Chemist  to  Laboratory  Supervisor 

2)  Laboratory  SNM  Custodian  to  Laboratory  Supervisor 

3)  Laboratory  Supervisor  to  Plant  Safeguards  Authority 

e.  Storage  Areas 

1)  Vault  Manager  to  Plant  Safeguards  Authority 

2)  Plant  Physical  Inspector  to  Plant  Safeguards  Authority 

f.  Off-site  Shipping  and  Receiving 

1)  Shipping  Dock  Clerk  to  Shipping  Dock  Foreman 

2)  Shipping  Dock  Foreman  to  Plant  Safeguards  Authority 

g.  Management 

1)  Plant  Safeguards  Authority  to  Plant  Manager 

2)  Physical  Security  Director  to  Plant  Manager 

3)  Plant  Safeguards  Committee  to  Plant  Manager 

2.  Transportation 

a.  SNM  Transportation  Custodian  to  Regional  Transportation  Control 

3.  Between  Plant  and  Field  Office 

a.  Plant  Manager  to  SS  Rep 

b.  Plant  Manager  to  Field  Office  Manager 

c.  Physical  Security  Director  to  Director  of  Security 

4.  Within  Field  Office 

a.  AEC  Survey  Inspector  to  SS  Rep 

b.  Regional  Transportation  Control  to  SS  Rep 

c.  Regional  Transportation  Control  to  Director  of  Security 

d.  SS  Rep  to  Field  Office  Manager 

e.  AEC  Security  Inspector  to  Director  of  Security 

f.  Director  of  Security  to  Field  Office  Manager 

5.  Between  Field  Office  and  AEC  Headquarters 

a.  Field  Office  Manager  to  Director,  DSS 

b.  Director  of  Security  to  Chief,   IS  Branch,  DSS 

c.  Director  of  Security  to  Director,  DSS 

6.  AEC  Headquarters  and  Top  Echelon  of  Government 

a.  AEC  Appraiser  to  Chief,   I&A  Branch,  DSS 

b.  Chief,   I&A  Branch,  DSS,   to  A/D,   I&A,  DSS 

c.  Chief,   IS  Branch,  DSS,   to  Director,  DSS 

d.  A/D,   I&A,   DSS,   to  Director,  DSS 

e.  Director,  DSS,  to  AGMNS 

f.  AGMNS  to  CM 

g.  GM  to  AEC  Commissioners 

h.  GM  to  JCAE 

i.  AEC  Commissioners  to  JCAE 

j.  AEC  Commissioners  to  the  President 
k.  The  President  to  the  Public 


Table  2    (continued)      The  Nodes  of  SIS 
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BIDIRECTIONAL  REPORTING  FLOWS  OF  INFORMATION 


R-OOl  President  -  AEC  Commissioners 
R-002  JCAE  -  AEC  Commissioners 
R-003  JCAE  -  GM 
R-004  AEC  Commissioners  -  GM 

R-005  AEC  Commissioners  -  Director  of  Regulationl 


R-006  GM  -  AGMNS 
R-007  AGMNS  -  Directo 
R-008  Director,  DSS  - 
R-009  Director,  DSS  - 
R-OlO  Director,  DSS  - 


•,  DSS 

A/D,   l&A,  DSS 

Chief,   I&A  Branch,  DSS 

Field  Office  Manager 


R- 

011 

Director , 

DSS  ■ 

-  SS  Rep 

R- 

012 

Director , 

DSS  ■ 

-  FBI  Headquarters 

R- 

013 

Director , 

DSS  • 

-  Field  Office  Director  of 

R- 

014 

Director , 

DSS  ■ 

-  Chief,   IS  Branch,  DSS 

R- 

015 

A/D,  I&A, 

DSS  ■ 

-  Chief,   I6cA  Branch,  DSS 

R-016  Chief,   l&A  Branch,  DSS  -  AEC  Appraiser 
R-017  Chief,   IS  Branch,  DSS  -  FBI  Headquarters 
R-018  Chief,   IS  Branch,  DSS  -  AEC  Appraiser 

R-019  Chief,  IS  Branch,  DSS  -  Field  Office  Director  of  Security 
R-020  AEC  Appraiser  -  SS  Rep 


R-021  AEC  Appraiser  -  Field  Office  Director  of  Security 
R-022  Field  Office  Manager  -  SS  Rep 

R-023  Field  Office  Manager  -  Field  Office  Director  of  Security 
R-024  Field  Office  Manager  -  Plant  Manager 
R-025  SS  Rep  -  Regional  Transportation  Control 

R-026  SS  Rep  -  AEC  Survey  Inspector 

R-027  SS  Rep  -  Plant  Manager 

R-028  SS  Rep  -  Plant  Safeguards  Authority 

R-029  Field  Office  Director  of  Security  -  Local  FBI 

R-030  Field  Office  Director  of  Security  -  Local  Law  Enforcement 


R-031  Field  Office  Director  of  Security  -  SS  Rep 

R-032  Field  Office  Director  of  Security  -  Regional  Transportation  Control 

R-033  Field  Office  Director  of  Security  -  AEC  Security  Inspector 

R-034  Field  Office  Director  of  Security  -  Plant  Manager 

R-035  Field  Office  Director  of  Security  -  Physical  Security  Director 


R-036  AEC  Survey  Inspector  -  Plant  Manager 

R-037  AEC  Survey  Inspector  -  Plant  Safeguards  Authority 

R-038  AEC  Survey  Inspector  -  AEC  Independent  Laboraotry 

R-039  AEC  Security  Inspector  -  Plant  Manager 

R-040  AEC  Security  Inspector  -  Physical  Security  Director 

Table  3      SIS  Information  Flows  as  a  Function  of  End-Point  Node 
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BIDIRECTIONAL  REPORTING  FLOWS  OF  INFORMATION  (continued) 


R-041  Regional  Transportation  Control  -  SNM  Transportation  Custodian 
R-042  Plant  Manager  -  Plant  Safeguards  Committee 
R-043  Plant  Manager  -  Plant  Safeguards  Authority 
R-044  Plant  Manager  -  Production  Control  Manager 
R-045  Plant  Manager  -  Physical  Security  Director 


-  Plant  Safeguards  Authority 

-  Production  Control  Manager 

-  Physical  Security  Director 

-  Plant  Safeguards  Authority  (other 

-  Production  Control  Manager 


R-046  Plant  Safeguards  Committee 

R-047  Plant  Safeguards  Committee 

R-048  Plant  Safeguards  Committee 

R-049  Plant  Safeguards  Authority 

R-050  Plant  Safeguards  Authority 

R-051  Plant  Safeguards  Authority 

R-052  Plant  Safeguards  Authority 

R-053  Plant  Safeguards  Authority 

R-054  Plant  Safeguards  Authority 

R-055  Plant  Safeguards  Authority 

R-056  Plant  Safeguards  Authority 

R-057  Plant  Safeguards  Authority 

R-058  Plant  Safeguards  Authority 

R-059  Plant  Safeguards  Authority 

R-060  Plant  Safeguards  Authority 

R-061  Plant  Safeguards  Authority 
R-062  Plant  Safeguards  Authority 
R-063  Production  Control  Manager 
R-064  Production  Control  Manager 
R-065  Production  Control  Manager 

R-066  Production  Control  Manager 
R-067  Physical  Security  Director 
R-068  Physical  Security  Director 
R-069  Physical  Security  Director 
R-070  Physical  Security  Director 


-  Physical  Security  Director 

-  Process  Engineer 

-  R&D  Supervisor 

-  Analytical  Laboratory  Supervisor 

-  Plant  Physical  Inspector 


-  Plant  Guard  Captain 

-  MBA  SNM  Custodian 

-  R6tD  SNM  Custodian 

-  Laboratory  SNM  Custodian 

-  Process  Foreman 

-  Shipping  Dock  Foreman 

-  Vault  Manager 

-  AEC  Survey  Inspector 

-  Process  Engineer 

-  MBA  SNM  Custodian 

-  Vault  Manager 

-  AEC  Security  Inspector 

-  Plant  Guard  Captain 

-  Plant  Guard 

-  Local  FBI 


R-071  Physical  Security  Dire 
R-072  Process  Engineer  -  AEC 
R-073  Process  Engineer  -  Pro 
R-074  Process  Engineer  -  R6cD 
R-075  Process  Engineer  -  Ana 


ctor  -  Local  Law  Enforcement 

Survey  Inspector 
cess  Engineer  (another  MBA) 

Supervisor 
lytical  Laboratory  Supervisor 


R-076  Process  Engineer  -  MBA  SNM  Custodian 
R-077  Process  Engineer  -  Process  Foreman 
R-078  Process  Engineer  -  Process  Operator 
R-079  Process  Foreman  -  AEC  Survey  Inspector 
R-080  Process  Foreman  -  MBA  SNM  Custodian 


Table  3    (continued)       SIS  Information  Flows  as  a  Function  of 

End-Point  Node 
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BIDIRECTIONAL  REPORTING  FLOWS  OF  INFORMATION  (continued) 


R-081  Process  Foreman  -  Process  Foreman  (adjacent  process  of  MBA) 

R-082  Process  Foreman  -  Process  Operator 

R-083  Process  Operator  -  Plant  Safeguards  Authority 

R-084  Process  Operator  -  MBA  SNM  Custodian 

R-085  Process  Operator  -  Process  Operator  (same  or  adjacent  unit  process) 


R-086  R&D  Supervisor  -  R&D  SNM  Custodian 

R-087  R&D  Supervisor  -  R&D  Technologist 

R-088  R&D  SNM  Custodian  -  R&D  Technologist 

R-089  R&D  Technologist  -  Plant  Safeguards  Authority 

R-090  Analytical  Laboratory  Supervisor  -  Laboratory  SNM  Custodian 

R-091  Analytical  Laboratory  Supervisor  -  Laboratory  Chemist 
R-092  Laboratory  SNM  Custodian  -  Laboratory  Chemist 
R-093  Laboratory  Chemist  -  Plant  Safeguards  Authority 
R-094  MBA  SNM  Custodian  -  AEC  Survey  Inspector 
R-095  R&D  SNM  Custodian  -  AEC  Survey  Inspector 

R-096  Laboratory  SNM  Custodian  -  AEC  Survey  Inspector 

R-097  MBA  SNM  Custodian  -  MBA  SNM  Custodian  (adjacent  MBA) 

R-098  MBA  SNM  Custodian  -  R&D  SNM  Custodian 

R-099  MBA  SNM  Custodian  -  Laboratory  SNM  Custodian 

R-lOO  R&D  SNM  Custodian  -  R&D  SNM  Custodian  (another  R&D  area) 


R-101  Laboratory  SNM  Custodian  -  Laboratory  SNM  Custodian  (another  laboratory) 
R-102  Plant  Physical  Inspector  -  AEC  Survey  Inspector 
R-103  Plant  Physical  Inspector  -  Plant  Manager 
R-104  Plant  Physical  Inspector  -  MBA  SNM  Custodian 
R-105  Plant  Physical   Inspector  -  R&D  SNM  Custodian 


R-106  Plant  Physical  Inspector  -  Laboratory  SNM  Custodian 
R-107  Plant  Physical  Inspector  -  Vault  Manager 
R-108  Vault  Manager  -  AEC  Survey  Inspector 
R-109  Vault  Manager  -  Process  Engineer 
R-110  Vault  Manager  -  MBA  SNM  Custodian 


R-111  Vault  Manager 
R-112  Vault  Manager 
R-113  Vault  Manager 
R-114  Vault  Manager 
R-115  Vault  Manager 


-  R&D  SNM  Custodian 

-  Laboratory  SNM  Custodian 

-  Process  Operator 

-  R&D  Technologist 

-  Laboratory  Chemist 


R-116  Vault  Manager  -  Plant  Guard 

R-117  Shipping  Dock  Foreman  -  AEC  Survey  Inspector 

R-118  Shipping  Dock  Foreman  -  Regional  Transportation  Control 

R-119  Shipping  Dock  Foreman  -  Plant  Manager 

R-120  Shipping  Dock  Foreman  -  Vault  Manager 

Table  3     (continued)       SIS  Information  Flows  as  a  Function  of 

End-Point  Node 
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BIDIRECTIONAL  REPORTING  FLOWS  OF  INFORMATION  (continued) 


R-121  Shipping  Dock  Foreman  -  Shipping  Dock  Clerk 

R-122  Shipping  Dock  Clerk  -  Plant  Safeguards  Authority 

R-123  Shipping  Dock  Clerk  -  MBA  SNM  Custodian 

R-12A  Shipping  Dock\  Clerk  -  R&D  SNM  Custodian 

R-125  Shipping  Dock  Clerk  -  Laboratory  SNM  Custodian 

R-126  Shipping  Dock  Clerk  -  Process  Operator 

R-127  Shipping  Dock  Clerk  -  Shipping  Dock  Clerk  (another  facility) 

R-128  Plant  Guard  Captain  -  AEC  Security  Inspector 

R-129  Plant  Guard  Captain  -  Plant  Manager 

R-130  Plant  Guard  Captain  -  Plant  Guard 

R-131  Plant  Guard  -  Plant  Safeguards  Authority 

R-132  Plant  Guard  -  Shipping  Dock  Foreman 

R-133  Plant  Guard  -  Plant  Guard 

R-134  SNM  Transportation  Custodian  -  SS  Rep 

R-135  SNM  Transportation  Custodian  -  Shipping  Dock  Clerk 

BIDIRECTIONAL  INFORMATION  FLOWS  TO  INFORMATION  AND  ANALYSIS  SYSTEMS 


S 

-001 

NMIS 

-  Director,  DSS 

S 

-002 

NMIS 

-  AEC  Appraiser 

s 

-003 

NMIS 

-  AEC  Survey  Inspector 

s 

-004 

NMIS 

-  SS  Rep 

s 

-005 

NMIS 

-  Plant  Safeguards  Authority 

s 

-006 

NMIS 

-  Plant  Data  Processing  System  (PDPS) 2 

s 

-007 

PDPS 

-  AEC  Survey  Inspector 

s 

-008 

PDPS 

-  Plant  Manager 

s 

-009 

PDPS 

-  Plant  Safeguards  Authority 

s 

-010 

PDPS 

-  Process  Engineer 

s 

-Oil 

PDPS 

-  SNM  Custodian  (MBA,  R&D  or  Laboratory) 

s 

-012 

PDPS 

-  Process  Foreman 

s 

-013 

PDPS 

-  Process  Operator 

s 

-014 

PDPS 

-  Shipping  Dock  Foreman 

s 

-015 

PDPS 

-  Shipping  Dock  Clerk 

s 

-016 

PDPS 

-  Plant  Physical  Inspector 

s 

-017 

PDPS 

-  Vault  Manager 

Safeguards  activities  of  Director  of  Regulation  beyond  scope  of  study. 
Information  flows  associated  with  Licensees  are  excluded  from  list. 

PDPS  comprised  of  plant  safeguards  data  base  and  related  materials  ac- 
counting and  data  monitoring  activities.     It  may  be  located  centrally  or 
be  dispersed  throughout  the  plant  and  can  be  computerized  or  manual. 

Table  3    (continued)       SIS  Information  Flows  as  a  Function  of 

End-Point  Node 
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I,  ABNORMAL  SITUATION  INFORMATION 

A.  Discovery 

1 .  How  much 

2.  From  where 

3.  Kind  of  material 

4.  First  observation 

5.  Time  window  for  occurrence 

6.  How  indicated 

7.  Possible  innocent  causes  of  indication 

8.  Who  made  first  report 

9.  Personnel  possibly  involved 

B.  Investigation 

1.  Past  actions  taken 

2.  Current  actions 

3.  Future  actions  to  be  taken 

4.  Correlative  and  corroborant  information 

a.  Within  node  discovering  abnormal  situation 

b.  Outside  of  node  discovering  abnormal  situation 
II.  MATERIAL  ACCOUNTING  INFORMATION 

A.  Transfer  information 

B.  Inventory  information 

C.  Inventory  change  information 

1.  Production 

2.  Accidental  loss 

3.  Decay 

4.  Burn-up 

5.  Measured  discard 

D.  Material  balance  accounting  information 

1.  MUF 

2.  Components  of  MUF  equation 

3.  Known,   localized  contributors  to  MUF 

4.  Uncertainty  of  MUF 

5.  Principal  contributors  to  uncertainty  of  MUF 

6.  Prior  period  adjustments 

III.   DIVERSION  PATH  ANALYSIS  INFORMATION 
IV.   SURVEY  INSPECTION  AND  APPRAISAL  INFORMATION 

V.  ASSURANCE  INFORMATION  AND  ASSURANCE  STATEMENTS 
VI.  MANAGEMENT  INFORMATION 

A.  Safeguards  policy 

B.  Other  administrative  directives  related  to  safeguards 
VII.  TECHNICAL  INFORMATION 

A.  Measurements  performed 

1.  Chemical 

2 .  Physical 

3.  Non-destructive 

B.  Calibration  techniques 

C.  Standards 

D.  Evaluation  of  measurements 

E.  Evaluation  techniques 

F.  Analysis  techniques 

VIII.    INFORMATION  IN  RESPONSE  TO  SPECIAL  SAFEGUARDS  RELATED  REQUESTS 

Table  4        Content  of  SIS  Information  Flows 
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information  and  reports  on  abnormal  situations,  analytical  surveillance 
exception  reports,  notification  of  changes  in  process  operations  which 
necessitate  review  of  diversion  path  analyses,  safeguards  system  design 
and  modification  information  and  suggestions,  diversion  path  analysis  data 
and  information,  general  observations  about  process  operations  and  notifi- 
cation of  safeguards  related  problems.     On  the  other  hand,  the  plant  safe- 
guards authority  returns  to  the  process  engineer  the  results  of  diversion 
path  analyses  for  his  area,   innocent  cause,   resolution  or  other  feedback 
information  about  reported  abnormal  situations,  allowable  elapsed  times 
for  reporting  abnormal  situations,  solutions  to  safeguards  problems  and 
safeguards  policy. 

The  following  procedure  is  used  for  characterizing  a  node  in  detail. 
Keeping  in  mind  the  specific  information  needs  derived  from  safeguards 
tasks,  activities  and  responsibilities  incumbent  on  the  node,  review  is 
made  of  information  and  data  generating  activities  within  the  node 
(description  of  the  node) ,  and  of  the  documentation  concerning  node 
activities  which  is  prepared  and/or  maintained  in  the  node  (content  of 
the  node).     The  identities  of  other  nodes  with  which  this  node  interacts 
are  derived  through  examination  of  the  description  and  content  of  this 
node  and  of  each  of  the  other  nodes,  at  all  levels  in  the  SIS  structure 
(see  Figure  2),   in  order  to  determine  the  available  sources  for  the 
information  needed  by  this  node  and,   in  light  of  the  information  needs  of 
other  nodes,   in  order  to  specify  the  information  which  this  node  is 
capable  of  furnishing.     Such  examination  reveals  the  information  and  data 
to  be  transmitted  (content  of  flows)   from  and  to  the  identified  nodes 
and  divides  reporting  from  administrative  flows   (purpose  of  flow).  Whether 
the  flow  is  oral  or  written  (method  of  flow)   is  also  revealed  and  is 
contingent  upon  both  the  content  of  flow  and  the  identity  of  the  interact- 
ing node.     The  method  of  flow  is  also  governed,   in  part,  by  some  basic 
premises,  applied  system-wide,  regarding  certain  contents  of  flow.  For 
example,   the  notification  of  abnormal  situation  alerts  and  alarms  should 
be  made  quickly,  whereas  the  supporting  reports   (which  might  be  used  for 
investigative  actions  or  at  the  time  of  system  review)   should  be  prepared 
within  some  specified  time  while  events  are  still  fresh  in  the  mind.  Thus, 
this  premise  dictates  an  oral  flow  (probably  by  telephone)   in  the  case  of 
alerts  and  alarms  and  a  written  flow  (because  of  the  intended  end-use)  in 
the  case  of  the  supporting  report.     Another  premise  relates  to  the 
supporting  report  as  prepared  by  nodes  at  lower  levels  of  the  SIS  structure 
(e.g.,  a  process  operator).     The  report  is  required  to  be  brief,  giving  only 
pertinent  facts   (date,   time  and  location  of  discovery,   identification  of 
discoverer,  nature  of  the  event,  SNM  type  and  estimated  quantity  involved, 
and  initial  actions  taken).     Brevity  is  dictated  in  order  to  reduce  cumber- 
some report  preparation  which  might  deter  filing  and,  further,  to  minimize 
reporting  costs  in  cases  of  innocent  cause. 

The  procedure  is  applied  in  an  iterative  manner  starting  with  a  node 
at  the  lowest  level  in  the  decision  structure.     In  the  development  of  SIS 
the  process  operator  node  was  the  first  to  be  characterized:  his  operational 
duties  bring  him  into  contact  with  SNM  which  makes  him  a  first-hand  observer 
of  abnormal  situations,   the  data  and  information  which  he  receives  and  sends 
is  well  established,  and  his  information  needs  (derived  prior  to  undertaking 
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the  detailed  characterization)  and  safeguards  tasks,  activities  and 
responsibilities  are  not  complex.      (Such  a  decision  maker  would  serve  well 
as  the  starting  point  for  design  a  plant  SIS.) 

When  the  process  operator  node  was  first  reviewed,  attention  was  given 
to  the  information  and  data  received,  tempered  by  Information  needs,  noting 
the  sources.     The  data  which  results  from  operational  activities  was  noted 
together  with  the  records  and  logs  he  maintains  and  the  forms  and  reports 
which  he  prepares.     Further  note  was  made  of  each  decision  maker  to  whom  he 
sends  forms  and  reports  and  those  who  review  his  records  and  logs;  such 
decision  makers  would  normally  be  prescribed  in  operating  and/or  internal 
control  procedures.     All  of  this  information  was  recorded  in  a  suitable 
format   (an  example  of  which  is  shown  later  with  reference  to'  the  plant 
safeguards  authority)  and  a  schematic  drawing  was  prepared  to  indicate  the 
identified  details.     The  detailed  characterization  of  the  node  at  the  next 
higher  level  in  the  SIS  structure  (process  foreman)  was  then  begun,  building 
on  the  characterization  of  the  process  operator.     The  procedure  was  repeated 
until  the  detailed  characterization  of  each  node  was  accomplished. 

As  one  characterizes  nodes  at  higher  levels  in  the  structure,  the 
complexity  of  the  contents  of  the  nodes  and  contents  of  the  flows  increases. 
Particularly  for  higher  level  nodes,   the  schematic  drawing  of  completed 
nodes  becomes  important.     The  identity  of  interacting  nodes  at  lower  levels, 
as  well  as  the  content  of  the  information  flows  from  these  nodes,  are 
readily  apparent  through  study  of  the  diagrams.     Thus,  comparison  of  the 
diagrams  assures  completeness  and  reduces  the  possibility  of  missing  any 
flows.     Further,  as  one  characterizes  nodes  at  higher  levels  in  the  structure, 
it  may  be  found  that  an  information  flow  to  a  lower  level  node  was  not 
recognized  earlier  or  that  the  content  of  a  flow  was  incorrectly  or,  more 
generally,  incompletely  perceived.     The  schematic  provides  a  means  for 
quickly  detecting  the  error.     Discovery  of  such  errors  necessitates  an  iter- 
ation through  all  completed  characterizations  in  order  to  up-date  the  written 
narratives  and  schematic  drawings  of  affected  nodes. 

By  carrying  the  procedure  to  completion,  one  is  assured  that  all  elements 
listed  in  Tables  2,   3  and  4  are  addressed,   that  all  interacting  nodes  are 
accounted  for,  and  that  the  content  of  the  information  flowing  through  the 
system  leads  to  satisfaction  of  safeguards  goals. 

With  this  background  on  procedure  in  mind,   the  detailed  characterization 
the  plant  safeguards  authority  node  can  now  be  stated.     It  is  presented  in 
the  format  used  in  the  comprehensive  report   [1]  for  each  node  of  SIS:  the 
general  node  description  (location  and  decision  maker) ;  summary  of  the 
information  needs   (as  derived  in  Section  4  above) ;  and  the  characterization 
of  the  node  in  terms  of   (1)   incoming  information  flows,   (2)   information  and 
data  generated,    (3)  records  maintained,   (4)   records  and  reports  prepared,  and 
(5)  outgoing  information  flows. 

The  general  node  description  and  summary  of  information  needs  are 
repetitious,  but  are  restated  here  in  order  to  bring  together  all  pertinent 
information  about  the  node.     The  characterization  is  given  in  outline  form  in 
order  to  present  the  details  as  concisely  as  possible.     Study  of  the  outline 
reveals  the  nodes  with  which  the  plant  safeguards  authority  interacts  and  the 
content  of  the  information  flows  received  from  and  sent  to  these  nodes.  The 
content  of  the  plant  safeguards  authority  node  itself  is  also  revealed. 
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The  schematic  drawing  of  the  detailed  characterization  is  shown  in 
Figures  7  and  7a  using  the  symbols  from  Figure  1.     Symbols  with  solid  borders 
represent  characteristics  directly  associated  with  the  plant  safeguards 
authority,  whereas  dashed  borders  indicate  interacting  characteristics  from 
adjacent  nodes.     Space  limitations  prevent  complete  annotation  of  the  content 
of  flows;  numbered  circles  refer  the  reader  to  the  similarly  keyed  listing 
appearing  above  Figure  7a  (for  annotations  of  the  contents  of  flows  to  higher 
levels  in  the  SIS  structure)  and  also   (for  all  interacting  nodes)  to 
similarly  keyed  section  in  the  outline  where  the  description  of  the  contents 
of  a  particular  flow  is  given.     Decision  makers  who  prepare  reports  flowing 
to  the  node  are  identified  by  means  of  small,  labelled,  dashed  diamonds. 
The  identity  of  the  decision  makers,   thus  labelled,   is  given  in  the  list 
above  and  to  the  left  of  Figure  7a;  upper  case  letters  are  used  to  desig- 
nate groups  of  decision  makers,  each  of  whom  sends  information  having  the 
same  general  content  as  indicated,  and  lower  case  letters  are  used  to 
designate  individual  decision  makers. 

By  setting  down  the  detailed  description  of  SIS  in  the  manner  described, 
two  aims  are  achieved.     First,   insurance  is  given  that  all  pertinent  infor- 
mation is  transmitted  along  the  flows  indicated  in  Table  3,   that  all  flow 
contents  listed  in  Table  4  are  considered,  that  the  decision  maker  receives 
only  the  information  he  needs  in  order  to  reach  his  decisions  and  is  not 
overburdened  with  extraneous  information,  and  that  a  system  of  checks  and 
balances  is  maintained  between  nodes,  allowing  decision  makers  to  present 
meaningful  assurance  statements. 

Second,  it  should  be  apparent  that  design  of  an  information  system  to 
satisfy  safeguards  goals  is  rather  laborious  and  time  consuming.  Thus, 
when  design  of  a  plant-specific  SIS  is  undertaken,   the  bulk  of  the  effort 
required  of  the  designer  has  already  been  done  for  him  and  the  benefits 
accruing  from  the  first  aim  are  automatically  assured  if  the  safeguards 
tasks,  activities  and  responsibilities  of  plant  personnel  can  be  brought 
into  line  with  those  set-forth  in  the  general  SIS. 
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5.1 


General  Node  Description 


Location:  PLANT 

Decision  Maker:     PLANT  SAFEGUARDS  AUTHORITY 

5 . 2  Summary  of  Information  Needs 

Facility-wide  SNM  accounting  records 
Results  of  physical  inventories 

Facility  MUF  and  uncertainty  of  MUF  data  with  description  of  sources 
Narrative  explanations  of  MUF 

Current  and  historical  S-R  data  (inter-  and  intra-plant) 
Calibration  program  measurement  data 
Data  on  uncertainty  of  measurements 
Production  control  data 

Changes  in  production  operations  within  unit  processes  (periodic) 
Full  particulars  of  irregular  events  such  as  fires,  demonstrations 

or  natural  disasters 
Overall  knowledge  of  attractiveness,   form  and  quantity  of  SNM  in 

MBA' s  and  unit  processes 

5 . 3  Characterization  of  Node 

Information  flows  associated  with  the  node  are  illustrated  schematically 
in  Figures  7  and  7a,  and  pertinent  details  of  the  content  of  the  node  and 
content  of  the  flows  are  given  in  the  following  outline. 

INCOMING  INFORMATION  FLOWS  TO  THIS  NODE 
A.     From  process  foreman 

1.   Abnormal  situation  reports  and/or  copies  of  log  entries 

a.  If  discoverer  is  sender  (copy  of  log  entry) 

1)  Date  and  time  of  discovery 

2)  Identification  (man-  or  badge-number)  of  discoverer 

3)  Statement  of  pertinent  facts 

a)  Material  type 

b)  Quantity 

c)  Location 

d)  Initial  actions  taken 

b.  If  discoverer  is  subordinate  of  sender  (report) 

1)  Date  and  time  of  notification 

2)  Identification  of  process  operator 

3)  Unit  process  involved 

4)  Actions  taken  for  abnormal  situation  verification 

5)  Date  and  time  process  engineer  notified  by  process 
foreman  if  abnormal  situation  unresolved  during 
allowed  elapsed  time 

6)  Statement  of  resolution  if  abnormal  situation 
cleared-up  using  information  available  to  pro- 
cess foreman  but  not  to  process  operator 
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a)  Explanation  of  innocent  cause,  or 

b)  Description  of  operational  error,  or 

c)  Indicator  of  safeguards  system  design 
error 

2.  Diversion  path  analysis  information 

B.  From  MBA  SNM  custodian 

1.   Copies  of  abnormal  situation  log  entries 

a.  Date  and  time  of  discovery 

b.  Identification  (man-  or  badge-number)  of  discoverer 

c.  Brief  statement  of  pertinent  facts 

1)  Material  type 

2)  Quantity 

3)  Location 

4)  Initial  actions  taken 

C.  From  process  engineer 

1.  Abnormal  situation  information  and  alerts 

a.  Discovery 

b.  Investigative 

c.  Innocent  cause 

d.  Resolution 

2.  Abnormal  situation  reports  and/or  copies  of  log  entries 

a.  If  discoverer  is  sender  (copy  of  log  entry) 

1)  Date  and  time  of  discovery 

2)  Identification  (man-  or  badge-number)  of 
discoverer 

3)  Complete  statement  of  pertinent  facts 

a)  Material  type 

b)  Quantity 

c)  Location 

d)  Analytical  surveillance  indicator 

e)  Diversion  path  description 

f)  Initial  actions  taken 

b.  If  discoverer  is  subordinate  of  sender  (report) 

1)  Date  and  time  of  notification 

2)  Identification  of  process  operator,  process  foreman 
or  MBA  SNM  custodian 

3)  Unit  process  or  MBA  involved 

4)  Actions  taken  for  abnormal  situation  verification 

5)  Date  and  time  plant  safeguards  authority  notified 
by  process  engineer  if  abnormal  situation  un- 
resolved during  allowed  elapsed  time 

6)  Statement  of  resolution  if  abnormal  situation 
cleared-up  using  information  available  to  process 
engineer  but  not  to  discoverer 

a)  Explanation  of  innocent  cause,  or 

b)  Description  of  operational  error,  or 

c)  Indicator  of  safeguards  system  design  error 

3.  Analytical  surveillance  exception  reports 

4.  Changes  in  process  operations  or  in  production  control 
rules,  regulations  and  procedures  which  make  diversion 
path  analysis  review  necessary 
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5.  Information  from  periodic  review  of  safeguards  aspects 
of  plant-specific  rules,  regulations  and  procedures 
which  govern  unit  process  or  MBA  production  activities 

6.  Other  information 

a.  Safeguards  system  design  and  modification  information 

b.  Diversion  path  analysis  information 

c.  Observations  relating  to  MBA  or  unit  process 
activities 

d.  Notification  of  problems  arising  from  MBA  or  unit 
process  activities 

e.  Assurance  information 
From  R&D  SNM  custodian 

1.  Copies  of  abnormal  situation  log  entries 

a.  Date  and  time  of  discovery 

b.  Identification  (man-  or  badge-number)  of  discoverer 

c.  Brief  statement  of  pertinent  facts 

1)  Material  type 

2)  Quantity 

3)  Location 

4)  Initial  actions  taken 
From  R&D  supervisor 

1.  Abnormal  situation  information  and  alerts 

a.  Discovery 

b.  Investigative 

c.  Innocent  cause 

d.  Resolution 

2.  Abnormal  situation  reports  and/or  copies  of  log  entries 

a.  If  discoverer  is  sender  (copy  of  log  entry) 

1)  Date  and  time  of  discovery 

2)  Identification  (man-  or  badge-number)  of 
discoverer 

3)  Complete  statement  of  pertinent  facts 

a)  Material  type 

b)  Quantity 

c)  Location 

d)  Diversion  path  description 

e)  Initial  actions  taken 

b.  If  discoverer  is  subordinate  of  sender  (report) 

1)  Date  and  time  of  notification 

2)  Identification  of  R&D  technologist  or  R&D  SNM 
custodian 

3)  R&D  area  involved 

4)  Actions  taken  for  abnormal  situation  verification 

5)  Date  and  time  plant  safeguards  authority  notified 
by  R&D  supervisor  if  abnormal  situation  unresolved 
during  allowed  elapsed  time 

6)  Statement  of  resolution  if  abnormal  situation 
cleared-up  using  information  available  to  R&D 
supervisor  but  not  to  discoverer 

a)  Explanation  of  innocent  cause,  or 

b)  Description  of  operational  error,  or 

c)  Indicator  of  safeguards  system  design  error 
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R&D  results  applicable  to  safeguards  (if  performed) 
Information  from  periodic  review  of  safeguards  aspects 
of  plant-specific  rules,  regulations  and  procedures 
which  govern  R&D  area  activities 
Other  information 

a.  Safeguards  system  design  and  modification  information 

b.  Diversion  path  analysis  information 

c.  Observations  relating  to  R&D  area  activities 

d.  Notification  of  problems  arising  from  R&D  area 
activities 

e.  Assurance  information 
om  laboratory  SNM  custodian 

Copies  of  abnormal  situation  log  entries 

a.  Date  and  time  of  discovery 

b.  Identification  (man-  or  badge-number)  of  discoverer 

c.  Brief  statement  of  pertinent  facts 

1)  Material  type 

2)  Quantity 

3)  Location 

4)  Initial  actions  taken 

om  analytical  laboratory  supervisor 
Abnormal  situation  information  and  alerts 

a.  Discovery 

b.  Investigative 

c.  Innocent  cause 

d.  Resolution 

Abnormal  situation  reports  and/or  copies  of  log  entries 

a.  If  discoverer  is  sender   (copy  of  log  entry) 

1)  Date  and  time  of  discovery 

2)  Identification  (man-  or  badge-number)  of  discoverer 

3)  Complete  statement  of  pertinent  facts 

a)  Material  type 

b)  Quantity 

c)  Location 

d)  Diversion  path  description 

e)  Initial  actions  taken 

b.  If  discoverer  is  subordinate  of  sender  (report) 

1)  Date  and  time  of  notification 

2)  Identification  of  analytical  chemist  or  laboratory 
SNM  custodian 

3)  Laboratory  involved 

4)  Actions  taken  for  abnormal  situation  verification 

5)  Date  and  time  plant  safeguards  authority  notified 
by  analytical  laboratory  supervisor  if  abnormal 
situation  unresolved  during  allowed  elapsed  time 

6)  Statement  of  resolution  if  abnormal  situation 
cleared-up  using  information  available  to 
analytical  laboratory  supervisor  but  not  to 
discoverer 

a)  Explanation  of  innocent  cause,  or 

b)  Description  of  operational  error,  or 

c)  Indicator  of  safeguards  system  design  error 
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3.  Calibration  program  data 
'  a.  Measurements 

b.  Uncertainties  associated  with  various  types  of 
measurements 

1)  Balances 

2)  Analytical  procedures 

3)  Isotoplc  concentration  determinations 

4)  Non-destructive  assay  or  test 
4)  Sampling 

4.  Results  of  specially  requested  measurements 

5.  Information  from  periodic  review  of  safeguards  aspects  of 
plant-specific  rules,  regulations  and  procedures  which 
govern  analytical  laboratory  activities 

6.  Other  Information 

a.  Safeguards  system  design  and  modification  Information 

b.  Diversion  path  analysis  information 

c.  Observations  relating  to  analytical  laboratory 
activities 

d.  Notification  of  problems  arising  from  analytical  lab- 
oratory activities 

e.  Assurance  Information 
From  vault  manager 

1.  Abnormal  situation  information  and  alerts 

a.  Discovery 

b.  Investigative 

c.  Innocent  cause 

d.  Resolution 

2.  Copies  of  abnormal  situation  log  entries 

a.  Date  and  time  of  discovery 

b.  Identification  (man-  or  badge-number)  of  discoverer 

c.  Brief  statement  of  pertinent  facts 

1)  Material  type 

2)  Quantity 

3)  Location  of  vault 

4)  Location  in  vault 

5)  Initial  actions  taken 
From  plant  physical  Inspector 

1.  Abnormal  situation  information  and  alerts 

a.  Discovery 

b.  Investigative 

c.  Innocent  cause 

d.  Resolution 

2.  Copies  of  abnormal  situation  log  entries 

a.  Date  and  time  of  discovery 

b.  Identification  (man-  or  badge-number)  of  discoverer 

c.  Brief  statement  of  pertinent  facts 

1)  Material  type 

2)  Quantity 

3)  Location 

4)  Initial  actions  taken 
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3.  Routine  reports  of  observations  and  inspections 

4.  Other  information 

a.  Notification  of  problems  arising  from  inspection 
activities 

b.  Diversion  path  analysis  information 

c.  Assurance  information 
From  shipping  dock  clerk 

1.  Copies  of  abnormal  situation  log  entries 

a.  Date  and  time  of  discovery 

b.  Identification  (man-  or  badge-number)  of  discoverer 

c.  Brief  statement  of  pertinent  facts 

1)  Material  type 

2)  Quantity 

3)  Location 

4)  Initial  actions  taken 
From  shipping  dock  foreman 

1.  Abnormal  situation  information  and  alerts 

a.  Discovery 

b.  Investigative 

c.  Innocent  cause 

d.  Resolution 

2.  Abnormal  situation  reports  and/or  copies  of  log  entries 

a.  If  discoverer  is  sender  (copy  of  log  entry) 

1)  Date  and  time  of  discovery 

2)  Identification  (man-  or  badge-number)  of 
discoverer 

3)  Brief  statement  of  pertinent  facts 

a)  Material  type 

b)  Quantity 

c)  Location 

d)  Initial  actions  taken 

b.  If  discoverer  is  subordinate  of  sender  (report) 

1)  Date  and  time  of  notification 

2)  Identification  of  shipping  dock  clerk 

3)  Shipping  dock  area  involved 

4)  Actions  taken  for  abnormal  situation  verification 

5)  Date  and  time  plant  safeguards  authority  notified 
by  shipping  dock  foreman  if  abnormal  situation 
unresolved  during  allowed  elapsed  time 

6)  Statement  of  resolution  if  abnormal  situation 
cleared-up  using  information  available  to  ship- 
ping dock  foreman  but  not  of  shipping  dock  clerk 

a)  Explanation  of  innocent  cause,  or 

b)  Description  of  activity  error,  or 

c)  Indicator  of  safeguards  system  design  error 

3.  Shipping  dock  activity  reports 

a.  Items  and/or  containers  received 

b.  Items  and/or  containers  transferred  on-site 

c.  Items  and/or  containers  shipped 

4.  Notification  of  receipts  or  shipments 
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Confirmation  that  regional  transportation  control  has 
been  notified  of  receipt  or  shipment 
Other  information 

a.  Safeguards  system  design  and  modification  suggestions 

b.  Diversion  path  analysis  information 

c.  Observations  relating  to  shipping  dock  activities 

d.  Notification  of  problems  arising  in  shipping  dock  area 

e.  Assurance  information 
om  plant  guard  captain 

Abnormal  situation  reports  and/or  copies  of  log  entries 

a.  If  discoverer  is  sender  (copy  of  log  entry) 

1)  Date  and  time  of  discovery 

2)  Identification  (man-  or  badge-number)  of 
discoverer 

3)  Statement  of  pertinent  facts 

a)  Location 

b)  Circumstances 

c)  Initial  actions  taken 

b.  If  discoverer  is  subordinate  of  sender  (report,  admin- 
istrative flow) 

1)  Date  and  time  of  notification 

2)  Identification  of  plant  guard 

3)  Area  of  facility  or  perimeter  involved 

4)  Actions  taken  for  abnormal  situation  verification 

5)  Date  and  time  physical  security  director,  plant 
safeguards  authority  and  plant  manager  notified  by 
plant  guard  captain  if  abnormal  situation  unresolved 
during  allowed  elapsed  time 

6)  Statement  of  resolution  if  abnormal  situation 
cleared-up  using  information  available  to  plant 
guard  captain  but  not  to  plant  guard 

a)  Explanation  of  innocent  cause,  or 

b)  Description  of  operational  error,  or 

c)  Indicator  of  safeguards  preventive  system 
design  error 

Information  from  periodic  review  of  abnormal  situation  log, 
prepared  by  plant  guard  captain,  when  verification  is  made 
that  physical  security  system,  as  it  applies  to  safeguards, 
is  correctly  designed  and  properly  functioning 
Other  information 

a.  Breach  of  physical  security  which  poses  a  safeguards 
problem  such  as  attempted  or  successful  entry  or  exit 
of  unauthorized  personnel  at  controlled  area  or  attempts 
to  bring  unauthorized  material  through  doorway  monitor 
or  past  gate  guard 

b.  Notification  of  irregular  events 

1)  Fires  or  accidents 

2)  Demonstrations 

3)  Natural  disasters 

c.  Information  on  material  recovery 
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From  process  operator,  process  foreman,  MBA  SNM  custodian, 
process  engineer,  R&D  technologist,  R&D  SNM  custodian,  R&D 
supervisor,  laboratory  chemist,  laboratory  SNM  custodian, 
analytical  laboratory  supervisor,  vault  manager,  plant 
physical  inspector,  shipping  dock  clerk,  shipping  dock 
foreman,  plant  guard  and  plant  guard  captain 

Based  on  periodic  review  of  abnormal  situation  logs 
prepared  by  these  decision  makers,   information  for  modi- 
fication of  plant  safeguards  system  or  for  verification 
of  correct  design  and  proper  functioning. 
From  production  control  manager 

1.  Abnormal  situation  information 

a.  Investigative 

b.  Innocent  cause 

c.  Resolution 

2.  Production  information 

a.  Production  control  data 

b.  Changes  in  process  operations 

c.  Changes  in  plant-specific  rules,  regulations 
and  procedures 

3.  Information  from  periodic  review  of  safeguards  related 
production  control  rules,  regulations  and  procedures 
for  verification  of  assurance  statements  and  of  cor- 
rectness of  design  and  proper  functioning  of  safeguards 
system 

4.  Other  information 

a.  Safeguards  system  design  and  modification  information 

b.  Diversion  path  analysis  information 

c.  Observations  of  process  area  activities 

d.  Notification  of  problems  arising  from  process  area 
activities 

e.  Assurance  information 
From  physical  security  director 

1.  Abnormal  situation  information 

a.  Discovery 

b.  Investigative 

c.  Innocent  cause 

d.  Resolution 

2.  Abnormal  situation  reports  from  subordinates 

a.  Date  and  time  of  notification 

b.  Identification  of  plant  guard  captain  or  plant 
guard 

c.  '  Area  of  facility  or  perimeter  involved 

d.  Actions  taken  for  abnormal  situation  verification 

e.  Date  and  time  plant  safeguards  authority,  plant  manager 
and  FBI  and/or  local  law  enforcement  authorities  noti- 
fied by  physical  security  director  if  abnormal  situation 
unresolved  during  allowed  elapsed  time 

f .  Statement  of  resolution  if  abnormal  situation  cleared-up 
using  information  available  to  physical  security 
director  but  not  to  plant  guard  captain 

1)  Explanation  of  innocent  cause,  or 
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2)  Description  of  operational  error,  or 

3)  Indicator  of  safeguards  preventive  system  design 
error 

3.  Information  from  periodic  review  of  safeguards  aspects  of 
physical  security  rules,  regulations  and  procedures,  pre- 
ventive system  analyses  and  abnormal  situation  reports  for 
verification  of  assurance  statements  and  of  correctness  of 
design  and  proper  functioning  of  physical  security  system 
as  it  applies  to  safeguards 

4.  Preventive  system  analyses  data 

5.  Law  enforcement  information  from  local  FBI  or  law  enforce- 
ment authorities  about  off-site  events 

a.  Discovery 

1)  Illegal  possession  outside  plant  perimeter 

2)  Cached  outside  plant  perimeter 

b.  Investigative 

c.  Resoloution  and/or  recovery 

6.  Irregular  event  information 

a.  Fires  and  accidents 

b.  Demonstrations 

c.  Natural  disasters 

7.  Other  information 

a.  Safeguards  system  design  and  modification  information 

b.  Diversion  path  analysis  information 

c.  Observations  concerning  physical  security  system 

d.  Notification  of  short  term  physical  security  problems, 
breach  of  physical  security  or  irregular  event  which 
might  require  ad  hoc  response  such  as  special  inven- 
tory of  area  involved 

e.  Assurance  information 
From  plant  safeguards  committee 

1.  Requests  for  information,  suggestions,  ad  hoc  studies 
and  diversion  path  analysis  summary  reports  and  work- 
papers of  specific  unit  processes  or  MBA's 

2.  Decisions  of  plant  safeguards  committee 

a.  For  plant  safeguards  authority  activities 

b.  To  be  passed  to  process  engineer,  R&D  supervisior, 
analytical  laboratory  supervisior,  vault  manager, 
plant  physical  inspector  and  shipping  dock  foreman 

From  plant  data  processing  (depending  on  sophistication  of 
plant  data  processing  system  and  facility-specific  procedures 
and  personnel  responsibilities) 

1.  Facility-wide  SNM  accounting  records 

2.  Physical  inventory  data 

3.  Current  and  prior  period  facility  MUF  data 

4.  Narrative  explanations  of  prior  period  MUF 

5.  Current  and  prior  period  S-R  data   (inter-  and  intra-plant) 

6.  Analytical  surveillance  results  and  reports 

7.  Safeguards  exception  reports  and  alarms 
From  plant  manager 

1.     Requests  for  assurance  information 
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2.  AEC  safeguards  policy  and  related  corporate  policy 

3.  Results  of  AEC  survey  inspections  as  they  relate  to 
safeguards 

From  plant  safeguards  authority  at  another  facility 

1.  S-R  information  and  data 

a.  Notification 

b.  Investigation 

c.  Resolution 

2.  Other  facility  shipping 

a.  Notification  by  telephone  of  shipment  and  estimated 
time  of  arrival 

b.  Teletype  (TTY)  confirmation  of  shipment 

1)  Date  and  time  of  shipment 

2)  Estimated  time  of  arrival 

3)  Items  or  containers  shipped 

a)  Type 

b)  Quantity 

c)  Contents 

d)  Seal  numbers 

4)  Carrier  information 

a)  Transportation  contractor  identification 

b)  SNM  transportation  custodian  identification  (if 
applicable 

c.  Receiver's  copies  of  Form  AEC  741 

3.  Other  facility  receiving 

a.  Notification  by  telephone  of  receipt 

b.  Teletype  (TTY)  confirmation  of  receipt 

1)  Date  and  time  of  receipt 

2)  Items  or  containers  received 

a)  Type 

b)  Quantity 

c)  Condition 

d)  Seal  numbers 

c.  Shipper's  copies  (returned  from  receiver)  of  Forms 
AEC  741  and/or  AEC  284 

From  regional  transportation  control 

1.  Notification  of  transportation  abnormal  situation  involvin 
facility  shipment 

2.  Requests  for  additional  information 

3.  Investigative  information 

4.  Resolution  information 
From  AEC  survey  inspector 

1.  AEC  safeguards  policy  and  directives 

2.  Results  of  AEC  sponsored  R&D  applicable  to  facility  safe- 
guards system 

3.  Requests  for  additional  samples  during  on-site  evaluation 

4.  Requests  for  additional  information  on  any  safeguards 
related  phase  of  facility  activity  during  on-site  or  off- 
site  evaluation 

5.  Preliminary  findings,  suggestions  and  recommendations  made 
during  exit  interview 
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V.     From  SS  rep 

1.  Requests  for  information,  resolution  or  investigation  of 
specific  safeguards  situations  and/or  problems 

2.  Follow-up  information  on  suggestions  or  recommendations 

3.  Results  of  AEC  sponsored  R&D  applicable  to  facility  safe- 
guards system 

4.  Off-site  analytical  laboratory  results  (when  applicable) 

5.  AEC  safeguards  policy  and  directives 
W.     From  NMIS 

1.  Requests  for  information  about  shipments  and  receipts 

a.  S-R 

b.  Measurement  uncertainties 

c.  Data  verification 

d.  Resolution  information 

2.  Material  transaction  error  reports 

3.  Material  accounting  balance  for  plant  verification 
INFORMATION  AND  DATA  GENERATED  AT  THIS  NODE 

A.  Information  for  diversion  path  analyses 

B.  Analytical  surveillance  data 

C.  Analytical  surveillance  exception  data 

D.  Information  for  safeguards  system  design  and  modification 

E.  Abnormal  situation  existence  verification 

F.  Abnormal  situation  investigation  and  resolution  information 

G.  Elapsed  time  information 

H.  Assurance  information 
RECORDS  MAINTAINED  AT  THIS  NODE 

A.  Diversion  path  analyses 

B.  Safeguards  system  design  records 

1.  Design  plans 

2.  Suggested  modifications  forwarded  by  facility  personnel 

C.  Abnormal  situation  records  (all  sources) 

1.  Notifications 

2.  Investigations 

3.  Innocent  causes 

4.  Resolutions 

D.  Safeguards  policy 

1.  AEC 

2.  Corporate 

E.  Plant-specific  rules,  regulations  and  procedures  for  production, 
R&D  and  laboratory  activities  which  interact  with  safeguards 
activities 

F.  Historical  AEC  survey  inspection  records  as  they  relate  to 
safeguards 

G.  Plant  safeguards  committee  recommendations,  decisions  and 
requirements 

H.  Current  and  historical  records   (may  be  maintained  by  plant  data 
processing  system  for  rapid  recall  by  plant  safeguards  authority 

1.  Analytical  surveillance 

2.  S-R 

3.  MUF 

4.  Uncertainty  of  MUF 

5.  Inventory 
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6.  Routine  physical  inspections 

7.  Calibration  program 

8.  Transportation 

9.  Material  receipt  and  transfer  (inter-  and  intra-plant) 

10.  Item  identity  change 

11.  Assurance  records 

IV.     RECORDS  AND  REPORTS  PREPARED  AT  THIS  NODE 

A.  Diversion  path  analyses 

B.  Safeguards  system  design  and  modification  reports 

C.  Plant-specific  rules,  regulations  and  procedures  for  safeguards 
activities 

D.  Records  of  assurance  statements 
(32)           E.     Abnormal  situation  reports 

^"^^  1.     Date  and  time  of  notification 

2.  Identification  of  notifier 

3.  Area  of  facility  involved 

4.  Actions  taken  for  abnormal  situation  verification 

5.  Date  and  time  physical  security  director,  plant  manager 
and  FBI  and/or  local  law  enforcement  authorities  (through 
physical  security  director)  notified  by  plant  safeguards 
authority  if  abnormal  situation  unresolved  during  allowed 
elapsed  time 

6.  Statement  of  resolution  if  abnormal  situation  cleared-up 
using  information  available  to  plant  safeguards  authority 
but  not  to  other  plant  personnel 

a.  Explanation  of  innocent  cause,  or 

b.  Description  of  operational  error,  or 

c.  Indicator  of  safeguards  system  design  error 

F.  Reports  to  plant  safeguards  committee 

G.  MUF  and  uncertainty  of  MUF  records 

H.  Shipper's  copies  of  Form  AEC  741  and  receiver's  copies  of 
Forms  AEC  741  and  AEC  284 

I.  Safeguards  activity  reports 
J.     Assurance  reports 

V.     OUTGOING  INFORKA.TION  FLOWS  FROM  THIS  NODE 
^32^  A.     To  process  engineer 

1.  Diversion  path  analyses  for  his  process  area 

2.  Abnormal  situation  information 

a.  Elapsed  time  allowed  before  notifying  next  echelon 
(each  type  of  abnormal  situation) 

b.  Innocent  cause  or  resolution 

c.  Feedback 

3.  Solutions  to  problems 

4.  Decisions  of  plant  safeguards  committee 

5.  Safeguards  policy  from  plant  management 
B.     To  R&D  supervisor 

1.  Diversion  path  analyses  for  his  R&D  area 

2.  Abnormal  situation  information 

a.  Elapsed  time  allowed  before  notifying  next  echelon 
(each  type  of  abnormal  situation) 

b.  Innocent  cause  or  resolution 

c.  Feedback 
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Solutions  to  problems 
Requests  for  special  R&D 
Decisions  of  plant  safeguards  conunittee 
Safeguards  policy  from  plant  management 
analytical  laboratory  supervisior 
Diversion  path  analyses  for  his  analytical  laboratory 
area 

Abnormal  situation  information 

a.  Elapsed  time  allowed  before  notifying  next  echelon 
(each  type  of  abnormal  situation) 

b.  Innocent  cause  or  resolution 

c.  Feedback 
Solutions  to  problems 

Requests  for  information  and  data 

a.  Calibration  program 

b.  Measurement  uncertainties 

c.  Non-routine  measurements 

d.  Special  samples 

Decisions  of  plant  safeguards  committee 
Safeguards  policy  from  plant  management 
vault  manager 
Solutions  to  problems  arising  from  vault  activities 
Abnormal  situation  information 

a.  Elapsed  time  allowed  before  notifying  next  echelon 
(each  type  of  abnormal  situation) 

b.  Innocent  cause  or  resolution 

c.  Feedback 

Decisions  of  plant  safeguards  committee 
Safeguards  policy  from  plant  management 
plant  physical  inspector 
Solutions  to  inspection  activity  problems 
Abnormal  situation  information 

a.  Elapsed  time  allowed  before  notifying  next  echelon 
(each  type  of  abnormal  situation) 

b.  Innocent  cause  or  resolution 

c.  Feedback 

Decisions  of  plant  safeguards  committee 
Safeguards  policy  from  plant  management 
shipping  dock  foreman 
Solutions  to  shipping  dock  activity  problems 
Decisions  of  plant  safeguards  committee 
Safeguards  policy  from  plant  management 
Receiving  activities 

a.  Notification  of  material  to  be  received   (may  be 
Teletype  (TTY)  notification  by  shipper) 

b.  Routing  for  material  to  be  transferred  on-site  afte 
receipt 

c.  Abnormal  situation  information 

1)  Elapsed  time  allowed  before  notifying  next  echel 
(each  type  of  abnormal  situation) 

2)  Innocent  cause  or  resolution 
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3)  Feedback 
Shipping  activities 

a.  List  of  items  and/or  containers  to  be  shipped 

b.  Authorization  for  shipment 

c.  Bill  of  lading  to  accompany  shipment 

d.  Shipping  labels 

e.  Information  on  seals 

f.  Designation  of  carrier 

g.  Information  for  verification  of  credentials  of  SNM 
transportation  custodian 

h.  Special  handling  instructions 

i.  Abnormal  situation  information 

1)  Elapsed  time  allowed  before  notifying  next  echelon 
(each  type  of  abnormal  situation) 

2)  Innocent  cause  or  resolution 

3)  Feedback 
plant  guard  captain 

Notification  of  abnormal  situation  where  immediate  action 

may  result  in  apprehension  and  recovery 

Notification  of  recovery  of  misplaced  material 
production  control  manager 

Change  in  safeguards  system  necessitating  modified 

production  regulation  or  procedure 

Safeguards  policy  decisions  from  plant  management 

Safeguards  system  design  and  modification  reports 

Diversion  path  analysis  reports 
physical  security  director 

Modifications  in  safeguards  system  which  require  modified 

plant-specific  physical  security  rules,  regulations  or 

procedures 

Safeguards  policy  decisions  from  plant  management 
Diversion  path  analysis  reports 
plant  safeguards  committee 
Information  and  data  specifically  requested 
a.  Details  of  facility  activities  relevant  to  safeguards 

1)  Operational  activities 

a)  Material  flows 

b)  Material  residence  times 

c)  Material  attractiveness 

d)  Changes  in  material  form  (physical  or  chemical) 

e)  Quality  control  measurements 

f)  Process  control  measurements 

g)  Measurement  programs 

h)  Measurement  points  and  techniques 

i)  Statistical  analyses  of  measurement  data 

j)  MUF  and  uncertainty  in  MUF  calculations  and 
supporting  information 

2)  Current  and  prior  period  accounting  information 

3)  Manuals  specifying  facility  rules,  regulations 
and  procedures 

a)  SNM  control 
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b)  Internal  control 

c)  Process  control 

d)  Quality  control 

e)  Health  and  safety 

f)  Physical  security 
4)  Corporate  safeguards  policy 

b.  Details  of  facility  safeguards  system 

1)  Design 

2)  Modifications  since  last  AEC  survey  or  meeting  of 
committee 

3)  Diversion  path  analyses 

a)  Abnormal  situations  considered 

b)  Ranking  and  coverage 

c)  Available  variables 

d)  Indicator  chosen 

e)  Mass,   time  and  space  sensitivity  of  selected 
indicator 

4)  Mass,  time  and  space  sensitivity  of  overall  system 

c.  Abnormal  situation  logs 

1)  Log  entries 

2)  Responses 

3)  Innocent  causes 

4)  Resolutions 

5)  Frequency  of  entries 

6)  Modifications  to  abnormal  situation  responses 
resulting  from  analysis  of  abnormal  situation  log 
entries 

d.  Allowable  elapsed  times  for  specific  abnormal  situations 

e.  Assurance  information 
Results  of  ad  hoc  studies 
Suggestions  and  recommendations 

^  4.     Diversion  path  analysis  summary  reports  and  workpapers 

5.  Diversion  path  analysis  up-date  information  necessitated 
by  changes  in  process  operations  or  production-control  or 
physical-security  rules,  regulations  and  procedures 

6.  Assurance  reports 

7.  Records  and  reports  for  periodic  review  by  committee 

a.  Abnormal  situation  records  and  reports 

b.  Current  and  prior  period  accounting  records  and  reports 

c.  MUF  records 

d.  Safeguards  system  design  and  modification  records 
and  reports 

e.  Safeguards  activity  reports 

f.  Assurance  statement  records 

g.  AEC  survey  inspection  records 

h.  Rules,  regulations  and  procedures 

i.  Safeguards  policy  records 

8.  New  information  for  committee  action  or  review  and/or 
follow-up  information 

a.   Abnormal  situation  information,  alerts  and  intelligence 
from  any  source 


® 


{I: 
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b.  Information  from  process  engineer,  R&D  supervisor, 
analytical  laboratory  supervisor,  plant  physical 
inspector  and  shipping  dock  foreman  concerning  their 
areas  of  responsibility 

1)  Periodic  reviews  of  plant-specific  rules,  regu- 
lations and  procedures 

2)  Safeguards  system  design  and  modification  sug- 
gestions 

3)  Diversion  path  analysis  information 

4)  Observations  of  activities 

5)  Notification  of  problems 

6)  Assurance 

c.  Periodic  reviews  of  abnormial  situation  logs,  diversion 
path  and  preventive  system  analyses 

d.  Inter-  and  intra-plant  S-R 

e.  MUF  evaluations 

f.  Breach  of  physical  security  which  poses  safeguards 
problem 

g.  Irregular  event  information 

h.  Investigations  of  specific  abnormal  situations 

i.  Verification  of  assurance  statements  and  of  correctness 
of  design  and  proper  functioning  of  overall  plant 
safeguards  system 

j.   Results  of  AEC  surveys  and  follow-ups 
Problems  having  safeguards  significance  which  require 
AEC  and/or  corporate  decisions  to  effect  solution 
Information  for  follow-up  to  Field  Office  suggestions 
or  recommendations 
Assurance  information 
plant  data  processing 
Requests  for  information  and  data  (facility-wide,  MBA 
or  unit  process) 

a.  SNM  accounting  records 

b.  Physical  and  book  inventory  data 

c.  Current  and  prior  period  MUF  data,  uncertainty  of  MUF 
and  narrative  explanations 

d.  Current  and  prior  period  S-R  data  (inter-  and  intra- 
plant) 

e.  Analysis  results  and  reports 

1)  Analytical  surveillance 

2)  Safeguards  exception  reports 
plant  manager 

Abnormal  situation  information,  alerts  and  intelligence 

a.  Discovery 

1)  Material  missing,  misplaced  or  found  on-site 

2)  Material  found  outside  plant  perimeter 

a)  Illegal  possession 

b)  Cached 

3)  Covert  threat  to  plant 

b.  Investigative 
1)  On-site 

a)  Plant  personnel  findings 
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b)  FBI  findings 
2)  Off-site 

a)  Local  law  enforcement  agency  findings 

b)  FBI  findings 

c.  Innocent  cause 

d.  Resolution  and/or  recovery 
Abnormal  situation  reports 

a.  If  plant  safeguards  authority  is  discoverer 

1)  Date  and  time  of  discovery 

2)  Identification  (man-  or  badge-number)  of  discoverer 

3)  Complete  statement  of  pertinent  facts 

a)  Material  type 

b)  Quantity 

c)  Location 

d)  Analytical  surveillance  indicator 

e)  Diversion  path  description 

f)  Initial  actions  taken 

4)  Date  and  time  production  control  manager,  physical 
security  director,  plant  manager,  SS  rep  and  FBI 
and/or  local  law  enforcement  authorities  (through 
physical  security  director)  notified  by  plant 
safeguards  authority  if  abnormal  situation 
unresolved  during  allowed  elapsed  time 

5)  Statement  of  resolution  if  abnormal  situation 
cleared-up  using  information  available  to  plant 
safeguards  authority 

a)  Explanation  of  innocent  cause,  or 

b)  Description  of  operational  error,  or 

c)  Indicator  of  safeguards  system  design  error 

b.  If  process  engineer,  R&D  supervisor,  analytical 
laboratory  supervisor,  vault  manager,  plant  physical 
inspector,  shipping  dock  foreman,  plant  guard 
captain,  production  control  manager  or  physical 
security  director  is  discoverer 

1)  Date  and  time  of  notification 

2)  Identification  of  notifier 

3)  Area  of  facility  or  perimeter  involved 

4)  Actions  taken  for  abnormal  situation  verification 

5)  Date  and  time  production  control  manager,  physical 
security  director,  plant  manager,  SS  rep  and  FBI 
and/or  local  law  enforcement  authorities  (through 
physical  security  director)  notified  by  plant 
safeguards  authority  if  abnormal  situation  unresolved 
during  allowed  elapsed  time 

6)  Statement  of  resolution  if  abnormal  situation  cleared 
up  using  information  available  to  production  control 
manager,  physical  security  director  nr  plant  safeguar 
authority  but  not  to  discoverer 

a)  Explanation  of  innocent  cause,  or 

b)  Description  of  operational  error,  or 

c)  Indicator  of  safeguards  system  design  error 
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3.  Administrative  information 

a.  Safeguards  system  design  and  modification  reports 

b.  Safeguards  activity  reports 

c.  Diversion  path  analysis  summary  reports 

d.  Assurance  reports 

4.  Other  Information 

a.  Problems  having  safeguards  significance  which  require 
AEC  and/or  corporate  decision  to  effect  solution 

b.  Assurance  information 

M.     To  plant  safeguards  authority  at  another  facility 

1.  S-R  information  and  data  (see  I.S.I.) 

2.  Teletype  (TTY)  confirmation  of  shipments  or  receipts 

a.  This  facility  shipping  (see  I.S.2.b.) 

b.  This  facility  receiving  (see  I.S.3.b.) 
N.     To  regional  transportation  control 

1.     Teletype  (TTY)  confirmation  of  shipments  or  receipts 

a.  This  facility  shipping  (see  I.S.2.b.) 

b.  This  facility  receiving  (see  I.S.3.b.) 
0.     To  AEC  survey  inspector 

r  1.   Details  of  facility  activities  relevant  to  safeguards 
J  (same  as  V.J.I.) 

1    2.  Records  and  reports  associated  with  safeguards  (see 
V.J. 7.) 

3.  Assurance  information  and  records 
P.     To  SS  rep 

1.  Abnormal  situation  information,  alerts  and  intelligence 
(same  as  V.L.I.) 

2.  Abnormal  situation  reports   (same  as  V.L,2.) 

3.  Copies  of  Forms  AEC  741  and/or  AEC  284  for  receipts  and 
Form  AEC  741  for  shipments 

r  4.   Safeguards  system  design  and  modification  reports 

<  5.  Safeguards  activity  reports 

6.  Diversion  path  analysis  summary  reports 

7.  Problems  having  safeguards  significance  which  require  AEC 
decision  to  effect  solution 

<  8.   Follow-up  information  on  Field  Office  suggestions  or  rec- 

ommendations 
9.  Assurance  information 
Q.     To  NMIS 

1.  Forms  AEC  741  and  AEC  284  information  on  receipts  and 
shipments  (if  facility  has  direct  input) 

2.  S-R  information 

3.  COEI  information 
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Figure  7      SIS  Information  Flows  Associated  with 
PLANT  SAFEGUARDS  AUTHORITY 
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Figure  7a      SIS  Information  Flows  Associated  with 
PLANT  SAFEGUARDS  AUTHORITY 
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